Someone in your office is probably already doing it. A contract goes in to be summarized, a spreadsheet of customers goes in to be cleaned up, an email from a client goes in to get a reply drafted. It saves time, and nobody means any harm. The question is whether it is safe. The honest answer is "it depends on what you paste and which account you paste it into," and this guide shows you how to decide.
What happens to text you paste
When you paste text into a public chatbot, it travels to the provider's servers, is processed there, and the answer comes back. After that, three things matter.
- Retention. The provider may keep your conversations for some period, for support, abuse monitoring or your own history.
- Training. On some plans, conversations can be used to improve the provider's models unless you turn that off. On business plans, providers generally say they do not train on your data, but you should read the terms of the plan you actually use, because they differ between providers, plans and dates.
- Access. Your data sits in an account. If that account is personal, shared by two people, or protected by a weak password, the data is only as safe as that login.
This guide does not describe any single vendor's current terms, because they change. Treat the questions as a checklist and read the terms of the plan in front of you.
The real risks, in plain terms
- Disclosure you did not intend. A client told you something under an agreement to keep it private. Sending it to a third party may break that agreement, even if the third party never looks at it.
- Rules about personal data. If the text contains names, addresses, ID numbers, health or financial details about real people, privacy rules in your sector or your clients' contracts may restrict where it can go.
- Mistakes you cannot undo. Once text has left, you cannot reliably pull it back. A deletion request is not the same as it never being sent.
- Wrong answers that look right. Chatbots produce fluent text that can be false. A summary of a contract can leave out the one clause that matters. That is a quality risk, separate from a privacy one.
- Instructions hidden in the text. A document or web page you paste in can contain wording meant to steer the model. If the chatbot is connected to your files or email, that matters more. Be careful about connecting a chatbot to anything it should not act on.
- Shadow accounts. Employees using personal logins means you cannot see what has been shared, cannot remove access when someone leaves, and cannot answer a client who asks.
A simple sorting rule
Sort what people might paste into three bins.
Never paste into a public chatbot
- anything a client marked confidential, or that sits under a non-disclosure agreement;
- passwords, keys, access codes and recovery phrases;
- personal identifiers: ID or tax numbers, bank and card numbers, medical details;
- unreleased financials, bids and pricing that a competitor would value;
- source code or drawings that are your own trade secrets.
Paste only after removing identifiers
- a client email you want help rewording: strip names, company, order numbers;
- a spreadsheet structure: keep the column layout, replace real rows with made-up ones;
- a contract clause you want explained: remove the parties.
Fine to paste
- public information such as your own published web page;
- text you wrote that holds nothing about clients;
- general questions with no company detail.
When in doubt, treat it as the first bin.
Pick the account on purpose
The account matters as much as the text.
- A business plan with administrative controls is a better place than a free personal account: you can see who has access, turn off history, and remove people when they leave.
- Settings. Find where the plan lets you turn off using your conversations for training, and set it for everyone.
- Sign-in. Use single sign-in or at least unique passwords with two-step verification, never a shared login.
- Written terms. Keep a copy of the terms you accepted. If a client asks, you can show what you agreed to.
Write a one-page policy
A policy that fits on one page gets read. Cover:
- Which tools are approved, and on which account.
- The three bins above, with two examples from your own work in each.
- A rule that anything going to a client gets read by a person before it is sent.
- Who to ask when unsure.
- What to do after a mistake: tell the owner the same day, so you can decide whether a client needs to hear about it.
Then tell people. A rule nobody knows about prevents nothing, and a rule that makes work impossible gets ignored. If people paste client data because the approved route is slow, fix the route.
Check your client contracts
Look at your agreements for clauses about subcontractors, third-party processors and data location. Some clients require approval before any outside party handles their information. Others ask you to say which tools you use. It is far easier to find that out now than after a client asks.
When a public chatbot is the wrong tool
If you want AI to work with your documents every day, such as answering questions from your policies, pulling fields out of invoices, or drafting from past proposals, a general chatbot is a poor fit. You would be pasting the same sensitive material again and again, by hand.
The other route is an assistant that runs on hardware you control or in a private cloud, answers only from your own documents, requires sign-in, and shows which document each answer came from. The data stays where you decide. It costs more to set up than a subscription, and it is only worth it for a workflow you use often. Start with one workflow, not with the whole company.
What to do this week
- Ask your employees, without blame, what they have already pasted.
- Move everyone to approved accounts.
- Turn off training on your conversations where the plan allows.
- Write and circulate the one-page policy.
- Pick one repetitive document task and note how long it takes today.
Next step: one workflow, assessed
If you have a document or question workflow that eats hours and involves data you cannot paste into a public tool, we can assess it. We look at one workflow, and you get a written plan and a price for handling it with AI that answers from your own documents and runs where you choose. We make no promises about accuracy figures we have not measured on your material, and every answer should cite its source.
Read more on the AI page, or describe the workflow through the contact form.