A customer asked what data you hold on them — what do I tell them?

Point them to the privacy page and support. The honest short version: name, number, delivery addresses, their orders — and message contents auto-purge on a schedule.