AI data privacy at work comes down to one habit: pause before you paste, and ask which tier the information belongs to.
This guide explains what not to paste into AI tools, why, and how to still get the help you need using placeholders. It is general education, not legal advice. Privacy rules vary by location and industry, and AI vendors change their data terms, so confirm the details for your own business and your own plan.
Why It Matters
When you paste text into an online AI tool, you are sending it to a third-party company. What happens next depends on that company's terms and your settings: how long it is kept, who at the vendor can see it, and whether it may be used to improve their models. Business plans often promise more protection than free consumer plans, but you only get the protection of the plan you are actually logged into.
There is also a quieter risk. Information you paste may end up inside a draft that gets forwarded, saved or shared further than you intended. The safest information is the information you never put in.
Would you be comfortable if this exact text were emailed to a stranger at another company? If not, it doesn't go in as written.
Never Paste These
- Passwords, API keys, recovery codes and login links. Rotate any credential you've pasted by mistake.
- Bank, card and payment details, including partial card numbers combined with names.
- Government ID numbers such as tax or social security numbers.
- Health information about customers or staff.
- Staff records: pay, performance reviews, disciplinary notes, home addresses.
- Anything covered by a confidentiality agreement with a client or supplier.
Paste or Not? Test Your Instincts
Six everyday situations. Choose what you'd do; each answer explains the reasoning. It runs entirely in your browser.
Paste or not?
- Your published menu, to rewrite descriptions
- An angry customer email you want help replying to
- The admin password, so it can explain a settings page
- Your customer list, to remove duplicates
- An employee's medical note, to draft a leave letter
- A supplier contract under NDA, to summarise
The NDA case is a judgment call. Some business plans and policies permit confidential documents; many agreements don't. When in doubt, treat it as tier three and keep it out.
Use Placeholders, Keep the Help
You rarely need real details to get a good draft. Replace them with obvious placeholders, get the draft, then fill the real details back in yourself.
Help me reply to this customer complaint. I've replaced personal details with placeholders; keep them as-is in your draft. "Hi, I'm [CUSTOMER]. My order [ORDER] arrived on [DATE] with two broken plates. This is the second time. I want a refund." Our policy: replacement or refund for items damaged in transit, customer chooses. Tone: sincere, brief, no excuses. Under 120 words.
The messy middle: details that identify anyway
A placeholder for the name isn't enough if the message says "the only vegan bakery on Main Street ordered forty cakes for the mayor's retirement". Unusual combinations identify people as surely as names. Strip context the assistant doesn't need.
Check Your Plan and Settings
| Question to answer | Where to look |
|---|---|
| Is my data used to train models? | The vendor's privacy policy and data settings for your plan |
| How long are chats kept? | Data retention section of the terms or help centre |
| Who on my team can see shared chats? | Workspace or team admin settings |
| Am I on a personal or business account? | Account page; look before every sensitive task |
Features and terms change often; check the vendor's current documentation rather than a blog post from last year, including this one.
Write a One-Page Policy
If more than one person uses AI tools in your business, write it down. A single page covering approved tools, the four tiers above, who signs off AI-drafted content, and who to ask when unsure prevents most problems. Pair it with the sign-off habit in how to check AI output for errors.
The Bottom Line
Sort before you paste: public goes in, internal goes into approved tools, confidential gets placeholders, restricted never goes in at all.
- Know which plan you are logged into.
- Placeholders keep the help without the risk.
- Write a one-page policy if anyone else uses AI.
Independent guide. Product names, features and data terms change often; check each vendor's current documentation before you rely on a feature. Nothing here is legal, security or professional advice.
