Keeping your data private with A.I.
By Chris Castleman · Updated October 17, 2026 · 6 min read
The most common worry I hear is "where does my information go?" It's a good question to ask. Here's how I think about it, and the habits I'd use in any small business, nonprofit or office.
The short version
- Don't type in anything you wouldn't put in an email to a vendor. Passwords, card numbers, Social Security numbers and medical details never go in.
- Use a paid business plan for business work. Their privacy terms are stronger than the free versions'.
- Check one setting: whether your chats are used to train the tool. Turn it off if you can.
That covers most of the risk. The rest of this page explains why.
Where your words go
When you type into an A.I. tool, your message goes to the company that runs it, which processes it on its servers and sends back a reply. That's no different from using Gmail or a cloud accounting app: you're trusting a company with your data, so it's worth knowing what they promise to do with it.
The big difference between plans is training. Some free and personal plans may use your conversations to improve future versions of the tool, unless you switch that off. Business and team plans generally don't, and they put that in writing. Look for a setting with a name like "Improve the model for everyone" or "Help improve," and read the plan's data page before you rely on it.
What never goes in
- Passwords, PINs and security questions
- Credit card and bank account numbers
- Social Security and driver's license numbers
- Medical or health information about anyone
- Anything you've promised a client or donor to keep confidential
What's usually fine, with care
- Your own writing: emails, posts, policies and plans you'd share with an employee.
- Public information: your website, menu, prices and reviews.
- Customer situations with the names taken out. "A customer says her order was late and cold" works just as well as her name and address. Swap names for "Customer A" and leave out anything that identifies them.
If you handle health information
If you work with protected health information, such as in a clinic, counseling office or home care, only use an A.I. tool that will sign a business associate agreement (a BAA) with you, and only on the plan that the agreement covers. If you're not sure, leave health details out entirely.
If you work for a public agency
What you write for work may be a public record, and A.I. chats used for work may count too. Before you start, ask your records officer or IT lead whether your agency has an A.I. policy and which tools are approved. Many agencies now do.
If you run a nonprofit
Donor and client information deserves the same care as customer data. The names-out habit works well here: ask A.I. to help with the thank-you letter template, then fill in the names yourself.
Check what comes back, too
Privacy isn't the only risk. A.I. tools can state wrong facts with total confidence. Before anything goes to a customer, a board or the public, read it as if a new employee wrote it: probably good, but worth checking.
How I handle your information
When I prepare for a consultation, I use paid business plans that don't train on what I type, and I leave out anything you've asked me to keep private. My privacy page has the details for this website.
If you'd like help setting up tools your team can use safely, book a time or ask me a question first.