In short. The question has two meanings. A chatbot pulls its answers from three big families of sources: the general knowledge of its AI model, a business knowledge base (your own content) and real-time data taken from your tools. At the same time, it also collects information about the person it is talking to, which brings GDPR rules into play.
Today, almost everything rides on the knowledge base: a technique called RAG lets the bot read your documents at the moment it answers, so replies stay accurate and current. In practice you feed it three ways: by importing the pages of your website, by uploading files (PDF, CSV and so on) and by connecting your tools.
“Where do chatbots get their information?” People usually ask right after watching an agent answer a very specific question about a company in a couple of seconds. Where did that answer come from? Can you trust it? And above all: how do you get a chatbot to actually know your business?
The short answer: a chatbot does not “know” anything by magic. It draws on sources that you choose and that you feed. Working out which ones is the key to getting accurate answers instead of rough approximations.
Two questions in one
Before getting into the detail, one ambiguity needs clearing up, because the question actually covers two very different topics.
1. Where the bot finds its answers: the knowledge sources it draws on to reply to you (internal knowledge base, documents, connected tools, AI). That is the main subject of this article.
2. What the bot collects about you: the information it records during the conversation (name, email, need, history). That one is about personalization, and about GDPR, covered further down.
The 5 sources a chatbot pulls its answers from
When a visitor asks a question, the bot can call on up to five types of source. The good agents combine several of them.
What the AI model already knows
A modern agent runs on a large language model, the kind behind ChatGPT, trained on enormous amounts of text. Very useful for language and general knowledge, but that knowledge is frozen at a cutoff date and holds nothing specific to your company.
Your business knowledge base
The heart of the matter. This is all of your content: website pages, FAQ, product sheets, procedures, documents. This is where the bot looks when it has to talk about your business with precision. Without it, it stays generic.
Your tools, in real time
Through integrations and APIs, the agent queries your software on the fly: CRM, e-commerce catalog, calendar, order tracking. The answer it gives is then personalized and current to the second (“your parcel ships tomorrow”).
A web search
Some bots can browse the web for public information that keeps changing (news, weather). Handy, but worth keeping on a leash: the reliability of open sources is never guaranteed.
The conversation in progress
The bot remembers what you just said, and sometimes your past exchanges, so it stays consistent: your first name, the product you mentioned, your problem. That source is also the one that touches personal data.
According to IBM, enterprise chatbots integrate tightly with CRM, ERP, HR and ticketing systems to pull real-time data and trigger actions. That is exactly the third source above, the one that turns a showcase bot into an assistant that genuinely gets work done.
Compared: the strengths and limits of each source
No source is perfect on its own. This table sums up what each one brings, and what it does not cover.
| Source | Freshness | Specific to you? | Best for |
|---|---|---|---|
| AI model | Frozen (training cutoff) | No | Language, rephrasing, general knowledge |
| Business knowledge base | Current if you maintain it | Yes | Offers, FAQ, procedures, return policy |
| Connected tools (API) | Real time | Yes | Stock, order tracking, appointments, customer record |
| Web search | Real time | No | News, general public information |
| Conversation | Instant | Yes (to the user) | Personalization, context, follow-up |
How does it work? RAG, explained simply
The mechanism that changed everything once generative AI arrived has a name: RAG, short for retrieval-augmented generation. It is what lets a chatbot answer from your documents, with no model retraining involved.
A method in which the chatbot first retrieves the relevant passages from a knowledge base, then hands them to the AI model as context for writing its reply. As AWS describes it, the AI leans on an authoritative knowledge base rather than on its training memory alone, which grounds answers in verifiable facts and sharply cuts the risk of hallucination.
Step by step, here is what happens when someone writes to a well-configured agent:
- The question gets analyzed. The bot turns the sentence into the meaning being searched for, beyond the exact words.
- It digs through your knowledge base. It finds the handful of passages closest to the question (your pages, your files), usually through what is called a vector search over embeddings.
- It assembles the context. Those excerpts go to the AI model along with the question.
- It writes the answer. The model produces a clear reply grounded in those excerpts, not in some fuzzy recollection.
- It can cite or act. Depending on the setup, it names the source, offers a link, or triggers an action (opening a ticket, booking an appointment).
Answer quality depends directly on the quality of the knowledge base. A clear, current, well-structured base gives you a good agent; an empty or expired one gives you a bot that either invents things or replies “I don’t know.”
3 concrete ways to feed your chatbot
Now for the practical side. To make an agent know your business, you fill its knowledge base. With a no-code platform like Botnation, that takes no developer and works in three complementary ways, walked through end to end in our guide to training a chatbot on your own data.
Import your website pages
The fastest source
You point to the pages to use (offers, pricing, shipping, legal notices and so on) and the platform pulls in their content. It is the quickest way to start from a solid base, since that information already exists and is, in principle, up to date.
Upload your files and documents
For what is not online
Not everything gets published on the site. You add documents (PDFs, spec sheets), a question-and-answer CSV file, a catalog, a price list. The bot uses them as an internal memory it can consult on demand.
Connect your tools
For living data
For everything that changes constantly (stock, orders, calendar, customer record), you do not copy the data: you plug into the source. Through integrations and API connections, the bot queries your CRM, your emailing tool or your calendar live.
The best-performing agents combine all three: website pages and files for the “stable” knowledge, connected tools for the “living” data. You keep control over every source and over how often it gets refreshed.
Your goals steer the knowledge base in different directions: a customer support bot leans mostly on the FAQ and the procedures; a smart FAQ bot on your pages and documents; a lead generation bot adds the collection of information about the visitor.
Checklist: does your chatbot have the right sources?
Check off what is already in place. The score tells you whether your agent is properly fed.
Is my chatbot well fed?
6 points that separate a generic bot from one that knows your business inside out.
What the chatbot collects about you (and GDPR)
Back to the second meaning of the question. While you chat, an agent can record data: first name, email, the need you expressed, pages viewed, history. That is what makes personalization, lead qualification and follow-up possible. But as soon as personal data is involved, GDPR applies.
- Be clear up front. The user has to know they are talking to a machine and what their data will be used for.
- Minimize. Ask only for what the stated purpose strictly requires (no reason to demand a date of birth to answer an after-sales question).
- Collect consent before gathering any personal information, and make access, correction and deletion easy.
- Protect minors. Under GDPR, a child’s data cannot be collected without parental consent below the age of digital consent, which each member state sets between 13 and 16.
Avoid collecting sensitive data with no need and no framework: health, political or religious opinions, passwords, a full payment card number. Payments go through a dedicated secure module, never through the chat window. France’s data protection authority, the CNIL, spells out these good practices in its guidance on respecting people’s rights.
In practice, the platform you pick helps you follow these rules. Botnation, for instance, is built in France and GDPR compliant: sensitive data (payment card numbers, phone numbers and the like) can be detected and anonymized right inside the visitor’s browser, before it ever reaches the servers, so the sensitive value never leaves the user’s device. The interface also provides data deletion tools, either wholesale or targeted, in real time.
For a chatbot you publish, you, the publisher, decide what data gets collected and you are the one accountable for it; the platform is only a tool. Always provide a way to reach you for deletion requests, and switch on only the integrations you genuinely use.
Common mistakes (and how to avoid them)
Most of the disappointment people feel with a chatbot comes from the knowledge base, not the AI model. The same traps come up again and again.
Avoid
- Relying on the AI model alone to talk about your company.
- Uploading documents, then never updating them.
- Letting the bot guess when it does not know (that is where hallucinations come from).
- Collecting data “just in case”, with no stated purpose.
Do
- Ground answers in your knowledge base (RAG) rather than in the model’s memory.
- Schedule a regular review of your sources.
- Plan a fallback answer and a human handoff.
- Ask only for what is strictly needed, and tell the user why.
Frequently asked questions
Where does a chatbot get its data from?
From three big families of sources: the general knowledge of its AI model, a business knowledge base that you feed (website pages, files, FAQ) and real-time data coming from your connected tools (CRM, e-commerce, calendar). It also remembers the thread of the conversation in progress.
How does a chatbot work, step by step?
It analyzes your question to work out what you mean, searches its knowledge base or its connected tools for the relevant information, picks the best answer, writes it in plain language and sends it back to you. If needed, it can also trigger an action such as opening a ticket or booking an appointment.
Where does ChatGPT get its information?
The model behind ChatGPT was trained beforehand on very large volumes of public text, which gives it general knowledge frozen at a cutoff date. It does not know your company. To get an assistant built on that kind of model to talk about your business, you add a dedicated knowledge base to it through RAG.
What information should a chatbot never ask for?
Sensitive data with no framework and no need: health, political or religious opinions, logins and passwords, a full payment card number. Any payment has to go through a secure module, not the chat window. When in doubt, apply minimization: ask only for what genuinely serves the stated purpose.
Can you connect a chatbot to your own website?
Yes. It is even the fastest way to feed it: you select the pages to use and the platform pulls in their content to build the knowledge base. You can then round it out with files and connected tools.
Build a chatbot that really knows your business
Import your pages, add your files, connect your tools, all without code. Give your agent the right sources for answers that are accurate and up to date.
