Before you paste anything into an AI tool
Data privacy and security were cited as a challenge by 50% of small business owners using AI in a Goldman Sachs 10,000 Small Businesses Voices survey (n=1,256, Jan to Feb 2026). Source, verified 2026-10-17.
This is a static checklist. Nothing you read here is collected or stored.
What to paste and what to hold back
| Type of information | What to do |
|---|---|
| Customer names, emails, phone numbers, addresses | Remove or replace with codes (Customer A). Use a business plan if you must include real details. |
| Payment card numbers, bank accounts, tax IDs, passwords | Never paste. No tool needs them to draft a reply. |
| Health, legal or HR details about a person | Do not paste. Ask a qualified professional how to handle it. |
| Contracts, supplier terms, price lists you promised to keep private | Check the contract. Use a plan with stronger data terms, or summarize it yourself first. |
| Your own public marketing copy, menus, FAQs | Usually fine to paste. Check anyway. |
| Meeting recordings and transcripts | Tell attendees. They can hold sensitive talk. Delete what you do not need. |
This table is our own general suggestion, not legal or security advice.
Three questions to ask before any tool
- Is this a personal plan or a business plan? Vendors often describe data use differently for each.
- Does the vendor say whether my content is used to train its models, and can I turn that off?
- Who else on my team can see what I paste?
What each vendor says (as of October 17, 2026)
- ChatGPT: OpenAI says business-plan data is not used for training by default. Individual plans differ; check settings. source
- Claude: Pricing page lists model training as Opt-out on Free/Pro/Max and None by default on Team. source
- Gemini (Google AI plans and Google Workspace): Google's Workspace Privacy Hub says Workspace content is not used for generative AI training outside your domain without permission. source
- Microsoft 365 Copilot: Check Microsoft's own commitments for your plan before pasting customer data. source
- Canva: Design files may include customer names or photos. Check what you upload. source
- Zapier: Automations pass data between apps. Only connect apps you would trust with that data. source
- Otter.ai: Transcripts can contain sensitive customer and pricing talk. source
- Fathom: Call recordings can contain sensitive customer details. source
- Grammarly: A writing checker reads text in the apps where it is installed. source
Claims in your own marketing
If you tell customers you use AI, or make claims about what AI does for them, the FTC says you need to be able to back those claims up. FTC: Keep your AI claims in check (verified 2026-10-17).