NIST's definition covers information that identifies someone directly, such as a name or a biometric record, and information that does so when combined with other linked data, such as a date and place of birth. The practical point is that PII is broader than most founders assume. An email address is PII. So is a phone number, a delivery address, and in many contexts an IP address or a device identifier tied to an account.
Almost every app holds some, and privacy laws such as the GDPR in Europe and the DPDP Act in India attach duties to it: collect it for a stated purpose, protect it and delete it when asked. AI-built apps tend to leak PII in ordinary ways. API responses return the whole user row when the screen needs only a display name. Tables of profiles are readable by any signed-in user. Personal details are written to logs, error trackers and analytics events, or pasted into prompts sent to a third-party model.
Start by writing down what personal data you hold and where it goes. Collect less, return only the fields a screen needs, restrict each user's records to that user, keep personal data out of logs and URLs, and encrypt the most sensitive fields. Have a working way to export and delete a user's data before someone asks for it.