What Not to Put In

This is the chapter most people skip and later wish they had not. It is short, and it is the one with real-world consequences.

The basic question

When you paste something into an AI tool, you are sending it to a company's servers. What happens next depends entirely on which tool and which tier you are using.

Many consumer tiers retain conversations and may use them to improve the model. The business tier of the same product often guarantees neither. The difference is in the terms, not in anything you can see on screen.

What should not go into a public tool

• Personal data about other people — clients, staff, customers. Names, addresses, phone numbers, email addresses, dates of birth.
• Health, financial or legal records. Anything sensitive about an identifiable person.
• Anything under an NDA.
• Passwords, keys, credentials. Ever, anywhere.
• Unreleased commercial information — pricing you have not announced, contracts in progress, anything you would not email to a stranger.

If you are in the UK or EU, personal data carries legal obligations under GDPR regardless of how convenient the tool is.

The fix is easier than the rule suggests

You almost never need the identifying details.

Draft a reply to a client who is unhappy that their project slipped by two weeks, where the delay was our fault and we have already offered a discount.

That gets you the same useful draft as pasting the real email, and sends nobody's personal data anywhere. Strip the names, keep the situation.

This one habit — describe the shape, not the identity — solves most of it.

Know where your safe door is

If you have a paid tier with contractual guarantees about retention and training, that is the tool to use when something sensitive genuinely must go in. Know which one it is before you need it, rather than deciding in a hurry.

Tell people, or decide not to

If AI helped produce work a client receives, decide your position on saying so — and be consistent. Trust is lost when people discover it, not when they are told.

If you have a team

Write half a page: what AI is encouraged for, what must never go in, when a human checks, and who to ask when unsure. Most breaches are not defiance. They are someone guessing, because nobody ever said.