Background
This project is for a small skincare business with very few employees & only a handful of strategic partners working with them. Thus resources are heavily constrained, so creative solutions need to be deployed.
If we are to work from the premise; “The safest data is the data you never collect” & by using the Precautionary Principle to apply the Principles of Maori Data Sovereignty — Te Mana Raraunga to all persons we serve, we can minimise any issues going forward.
Problem definition
To find the most effective ad spend, i.e. which services to advertise & which channels to advertise on.
Small businesses face significant challenges around where to not only spend their money, but also their time. As such it's extremely important to identify where to spend the very limited advertising budget that they have. Spending money on ineffective channels can lead to a downturn that can be extremely difficult to recover from.
Internally the business needs to correctly define the business purpose correctly such that if it is ever questioned there will be satisfctory answers.
By using AI we can reduce the complexity of combining the various data sources and quickly evaluate the most effective spend of advertising dollars.
As a small business, the responsibility for the whole project rests with only one person; the Marketer, & they will be accountable for outcomes.
The Business owner is the one who establishes the business objective(s) & defines the measures of success.
The Marketer provides additional knowledge around the current strengths & weaknesses with the current approach.
Would it be ethical to use AI in this way?
As a non-essential
service the optimisation of ads towards individuals who are most likely to
purchase would be acceptable, provided the system does not discriminate
unlawfully.
Is this Legal?
By following the principles of the Privacy Act,
this is a clear use case for this data.
Data collection & data preparation
Data collection
Data is collected from the Meta platform, Google search, Website analytics & the Appointment booking system.
During the customer journey at every opportunity the business shall make every attempt to inform our customers that the data that they submit & the data that we collect can be used for the purposes of marketing & related activities.
The data that is provided by 3rd parties comes with their own terms, which we unfortunately have no control over it's collection. However the use of that data passed onto us we can control & shall endeavour to keep securely & responsibly.
Additionally we shall record only the very bare minimum data (Name, phone & email) that we need to identify & contact them.
The Marketer collects the data from the outside parties as well as from the internal systems.
The External data platforms provide data outputs — which carries some inherited responsibility.
Only the minimum amount of data required for an appointment will be collected.
A clearly worded privacy statement disclosing the use of personal information, and a mechanism for customers to correct incorrect data needs to be consented.
All of the Third-parties data that is used to supplement the model's data requirements is an inherited liability that needs to be acknowledged.
Data preparation
Data will be cleaned i.e. transformed into a consistent format, structured & labeled.
Data will be anonymised before it enters model training, so as not to identify individuals.
Only the Marketer shall have access.
IT & the Marketer will; clean, format, structure & store the data securely.
The Business owner will approve the retention policies & determine who has access to the data.
Principle 5 of the Privacy Act, "states that organisations must ensure there are safeguards in place that are reasonable in the circumstances to prevent loss, misuse or disclosure of personal information."
The cleaning of the data could embed a bias based on the values of the individuals who clean the data.
Model development & training
With resources constrained, fine-tuning a pre-trained model would be the best course of action. This fine-tuning allows our knowledge to be incorporated into the model without us having to train it from scratch.
Before training is done there will need to be an evaluation of the data to establish if there were any bias introduced, & determine if there were any demographics underserved.
The data to be used shall be documented & oversight of the data inputted will need to performed by the Marketer.
IT is the principle who will select and fine-tune the chosen model.
The Marketer provides input into best practices & project guidance.
Here also the fine-tuning may also embed a bias based on the values of the individuals who fine-tune the data.
By using a pre-trained model there is a risk that it may come with it's own biases.
Model evaluation & refinement
The model is tested & evaluated against known behaviour as well as edge cases. This will be an iterative process & may involve stepping back the previous step.
Tests will need to be developed to determine if all segments will be served equally.
Likewise edge cases will be used to evaluate if the model is properly evaluating the data.
IT evaluates whether the model performs to expectations & supplied edge cases.
The Marketer evaluates whether the model reflects the real world & adds value to the business.
The Business owner will provide the final sign-off before deployment.
If there is inadequate testing, any biases or edge case failures will be missed resulting in an ineffective model.
All of the testing needs to be documented and the Business Owner needs to be kept abreast of developments.
Model deployment & monitoring
The model will be used in-house to evaluate the most effective ad spend.
The project should not be considered completed at this stage & ongoing monitoring will continue to ensure that the model meets the meets the original intent. It is conceivable that the model may drift with the addition of new data over time.
Most importantly humans need to stay involved in the process, & the model shall inform the decision making process.
The model & the data it contains shall remain as internal use only and shall not be shared with any outside parties.
IT & Marketing will monitor the model for drift & usefulness.
The Business owner will periodically review the performance of the model & will evaluate the suitability and purpose of the model.
A fully autonomous advertising system would be inherently very risky.
Any staff who will use this model need to be properly trained in it's use & need to fully understand it's limitations.
Data retirement
At some point in time it will become necessary to retire either the data and/or the model. Both to ensure that the project continues to meet its purpose & to meet any statutory obligations.
A scheduled review will be carried out every six months to ensure that the original intent of the project is still being meet.
All data after a period of two years will be deleted to ensure the model stays on course & to satisfy the NZ Privacy Act retention obligations.
At the end of it's lifecycle IT will destroy the data, its backups & the model.
Customers will have an expectation that the data will be deleted once they leave our patronage.
There will be an expectation that all copies of the data be deleted.
Principle 9 of the Privacy Act around the length of time data can be kept needs to be followed.
If data is leaked beyond the time we are permitted to use it there will be greater trust implications.
References
- Nwachukwu, D. (2026, March 2). The safest data is the data you never collected. LinkedIn. https://www.linkedin.com/posts/doranwachukwu_the-safest-data-is-the-data-you-never-collected-activity-7434138050366128128-zyFr
- Office of the Privacy Commissioner. (n.d.-a). Office of the Privacy Commissioner | Principle 5 - Storage and security of information. https://www.privacy.org.nz/privacy-principles/5/
- Office of the Privacy Commissioner. (n.d.-b). Office of the Privacy Commissioner | Principle 9 - Retention of personal information. https://www.privacy.org.nz/privacy-principles/9/