LESSON 07
WHAT NOT TO PASTE
INTO THE BOX.
The box accepts anything. That is the problem. There is no prompt asking whether you have the right to share what you just pasted, and no warning when you don't.
The default assumption to work from
Start here, and adjust upward only when you have read an actual agreement: anything you paste into a general consumer AI tool should be treated as information you no longer fully control.
That is not a claim that every provider is careless. Business and enterprise plans from major providers typically carry meaningful commitments about how your content is handled. The point is that the default posture protects you while you find out which plan you are actually on, and most people never find out.
There is a second exposure that has nothing to do with the vendor. Your conversation history sits in an account, and accounts get accessed by whoever has the password. A team member using a personal account for work has created a copy of your business information that leaves with them.
What 'training on your data' actually means
The phrase gets used loosely and it is worth unpacking, because the realistic risk is different from the one people imagine.
Training means your inputs may be used to improve future versions of the model. It does not mean your document is filed somewhere and handed to a competitor who asks the right question. Models absorb patterns across enormous volumes of text rather than storing individual documents for retrieval.
The realistic concerns are more mundane and more relevant to you. Your information is now held by a third party, in an account, subject to their retention policy and their security. Employees at the provider may review some conversations for quality and safety, which is standard practice and is disclosed. And if you had an obligation to a client or a seller about how their information is handled, you may have just breached it, regardless of what the provider does next.
Most business-tier plans let you turn training off, and many have it off by default. Find the setting. It takes five minutes and it is the highest-return five minutes in this entire course.
This page is part of a larger body of work — start with the full story behind this work.
The line, drawn concretely
| Fine in a general tool | Not in a general tool |
|---|---|
| Your own marketing copy | Social security numbers, ever |
| A process you are documenting | Bank account or card numbers |
| A public listing description | A seller's full financial picture with their name attached |
| General questions about a concept | Signed contracts with parties named |
| Notes with names and detail removed | Medical or family circumstances tied to a person |
| Your own draft writing | Employee records, payroll, discipline |
| Anonymized numbers for a calculation | Anything covered by an agreement you signed |
The workaround for most of the right column is simple and underused. Strip the identifying detail. A model helping you think through a difficult seller situation does not need her name, her address, or her account numbers. It needs the shape of the situation, which you can supply in two sentences.
Why this is heavier in a business that touches financial situations
If you sell software, a leaked prompt is an embarrassment. In a business where people come to you because they are behind on payments, inheriting a property they cannot afford, or going through a divorce, the information you hold is the most sensitive thing about their year.
Three consequences follow.
The first is trust, which is the actual asset. Sellers work with someone they believe will be discreet. That reputation takes years to build in a market like the Midlands, where people talk, and one incident to spend.
The second is obligation. Purchase agreements, lender relationships and service contracts often carry confidentiality terms. Pasting a document into a third-party tool can be a breach whether or not anything bad ever comes of it.
The third is regulatory, and it varies with what you do. Financial and health information carry specific handling requirements in some contexts. That is a question for your attorney about your specific business, not something to resolve with a general rule from a web page.
A policy small enough that people follow it
A twelve-page policy is a policy nobody reads. Write something short enough to fit on a card and specific enough to act on.
- Name the approved tool. One, on a business plan, with training off and accounts issued by the company.
- No personal accounts for company work. This is the rule most often broken and the one that quietly creates copies of your data.
- Never paste: identifiers, account numbers, signed contracts, employee records. A short, literal list beats a principle.
- Strip names and addresses when you can. Most tasks work perfectly well on anonymized input.
- When unsure, ask before pasting. Name who to ask so there is no ambiguity about where the question goes.
Five lines. Put it in writing, put it in onboarding, and revisit it when you add a tool. The failures here are almost never malicious. They are someone in a hurry who never thought about it because nobody ever told them to.
Frequently asked
Questions people actually ask
Is it safe to use AI for business at all?
Yes, with the same care you would apply to any third-party system holding your information. Use a business plan, turn training off, issue company accounts, and keep identifiers out of it. That combination covers most of the realistic risk.
Can my competitor see what I typed?
Not through the model in the way people imagine. Models learn patterns across enormous volumes of text rather than storing your document for retrieval. The realistic exposures are account access, retention, and obligations you may have to the person whose information it was.
What does turning off training actually do?
It stops your conversations being used to improve future models. It does not mean nothing is stored. Your history still lives in your account under the provider's retention policy, which is a separate setting worth reading.
Should I let my team use free AI accounts?
No. Free personal accounts mean company information sitting in accounts you do not control, under terms you have not read, that leave with the employee. Issue company accounts on a business plan.
Do I need a written AI policy?
If more than one person touches customer information, yes, and it should be short enough to actually be read. Five specific lines that people follow beats a comprehensive document that sits in a folder.
What if I already pasted something I should not have?
Delete the conversation, check whether your account retains history and for how long, and get the setting corrected going forward. If the information was covered by an agreement you signed, talk to your attorney rather than deciding on your own that it was fine.
Make your next move
A year from now, what will you be glad you started today?
You don't need another promise that everything will be easy. You need something useful to learn — and a next step you're willing to take.