AI can help you draft faster, organise ideas and analyse information—but the moment you paste real work into an AI tool, you may also be moving information outside the place where it was originally collected. For freelancers, consultants, creators and small businesses, the practical question is not simply “Is this AI tool safe?” It is “What information am I allowed to share, with this tool, for this task, under these settings and agreements?”
This guide gives you a usable privacy checklist rather than a blanket warning. You will learn what not to paste into public or unapproved AI tools, how to replace sensitive details with safe placeholders, what settings to check, and how to build a repeatable workflow that still lets you benefit from AI.
Quick rule: If you would not be comfortable sending the information to an unfamiliar external service, do not paste it into an AI tool until you have checked the tool, account, permissions, retention terms and your authority to share it.
On this page
- Why AI privacy matters
- What not to paste into AI tools
- A practical risk table
- How to anonymise or substitute information
- Settings and contract checks
- The CLEAR privacy workflow
- Safe examples for everyday work
- Copy-and-use checklist
- Frequently asked questions
Why AI privacy matters—even when your prompt seems harmless
Prompts often contain more than the question you want answered. A draft email may include a customer’s full name and order number. A spreadsheet may expose employee salaries. A legal summary may contain addresses, allegations or privileged communications. A “quick rewrite” can quietly transmit the very details that make the document confidential.
Risk depends on the information, the tool and account you use, the service’s data practices, your organisation’s rules, and any promises you have made to clients. A consumer account, an approved business workspace and an API-based application may have different controls. Never assume that every product from the same provider handles data identically.
For example, OpenAI explains that eligible personal ChatGPT accounts can control whether new conversations are used to improve models through Data Controls, while business offerings have different default data-use terms. Those settings are useful, but turning off model improvement does not by itself make it lawful or appropriate to disclose a client secret, remove chat history, satisfy a contract, or guarantee that no data is retained for any purpose. Read the terms for the specific service and account you actually use.
Official reference: OpenAI’s ChatGPT Data Controls guide.
What you should not paste into an AI tool without explicit approval
1. Passwords, access tokens and recovery secrets
Never paste passwords, one-time codes, private keys, API tokens, session cookies, recovery phrases or database credentials into a general-purpose chat. If you need help debugging, replace the secret with a placeholder such as API_KEY_REDACTED and share only the relevant error message. If a real secret has already been exposed, follow your provider’s process to revoke or rotate it.
2. Identifiable customer or employee information
Names combined with phone numbers, email addresses, national identity numbers, account details, home addresses, medical information, salary records or performance reviews can expose a person. Remove direct identifiers and consider whether indirect details—job title, location, dates, rare circumstances—could still identify them.
3. Confidential client files and unpublished business information
Client contracts, proposals, internal strategy, unreleased product plans, source code, pricing models, customer lists, sales forecasts and negotiation notes may be commercially sensitive. A client’s willingness to let you use AI should not be inferred from the fact that AI is available. Check the contract, confidentiality clause, client instructions and approved-tool list.
4. Legal, medical, financial or other high-stakes records
Do not upload complete case files, medical records, bank statements, tax documents, identity documents or sensitive legal correspondence to an unapproved tool. These records can combine highly sensitive facts in ways that are difficult to anonymise. Use a vetted environment only when you have authority to do so, and disclose the minimum necessary information.
5. Children’s information and vulnerable-person records
Be especially conservative with school reports, photographs, diagnoses, safeguarding notes, location details and family records involving children or vulnerable people. A name removal alone may not be enough. Avoid uploading identifiable information unless there is a clear lawful basis, a genuine need and appropriate safeguards.
6. Private communications and third-party content
Emails, WhatsApp exports, voice transcripts, private messages and meeting notes may include information about people who never agreed to have it processed by another service. Ask whether you need the full message at all. Often, a short fictionalised summary is sufficient.
7. Personal information that is unnecessary for the task
Even if you are allowed to process some data, do not share more than the task requires. To ask for a polite email, the AI usually needs the situation and desired tone—not the customer’s full identity, address, account number and entire history.
A practical risk table: pause, minimise or proceed
| Information | Default approach | Safer alternative |
|---|---|---|
| Passwords, tokens, private keys | Never paste | Use a placeholder; rotate exposed secrets |
| Customer names and contact details | Remove or replace | “Customer A”, fictional contact details |
| Contracts and client emails | Check permission and tool approval | Share only the relevant, redacted clause |
| Source code | Check company policy and licence | Minimal reproducible example without secrets |
| Medical, legal or financial records | Use only an approved, appropriate workflow | Generalised scenario or qualified professional review |
| Public information and your own generic draft | Usually lower risk; still review | Remove accidental personal details before sending |
This table is a cautious starting point, not a substitute for your client agreement, employer policy or applicable law. A “low-risk” label does not mean a tool is automatically approved for every use.
How to make a prompt safer without losing its usefulness
The goal is to preserve the structure needed to solve the problem while removing details that are not needed. Try this five-part method:
- Identify the task. State what you want the model to do: summarise, classify, rewrite, brainstorm or debug.
- Remove direct identifiers. Replace names, email addresses, phone numbers, account numbers, addresses and unique IDs.
- Generalise distinctive facts. Change exact dates, rare job titles, small locations or unusual events if they are not essential.
- Keep only the minimum excerpt. Share the smallest paragraph, code sample or data subset that can answer the question.
- Check for re-identification clues. Ask whether the remaining details could still point to a real person, client or confidential project.
Example — risky prompt: “Rewrite this complaint from Jane Perera, NIC 1982…, at 17 Example Road, about account 0049…”
Safer prompt: “Rewrite this fictionalised customer complaint in a calm, professional tone. Customer: [CUSTOMER]. Account: [ACCOUNT]. Keep the facts unchanged and do not invent a resolution: ‘[REDACTED COMPLAINT EXCERPT]’.”
Redaction is not magic. A unique combination of facts can still identify a person, and replacing names while uploading an entire original attachment defeats the purpose. Inspect the actual text and files you submit.
Before using a tool: five settings and agreement checks
- Account type: Are you signed into a personal account or an organisation-managed workspace?
- Model-improvement controls: Can you control whether eligible conversations are used to improve models? Confirm the setting for the account you are using.
- Retention and deletion: Understand what is stored, for how long, who can access it and what deletion does—and does not—remove.
- Connected apps and sharing: Check permissions for connected tools, shared links, uploaded files and third-party integrations.
- Permission and policy: Does your client, employer, professional duty, licence or agreement permit this data to be processed by this specific service?
For ChatGPT, the current path for eligible personal accounts is Settings → Data Controls → “Improve the model for everyone.” The setting applies to new conversations and does not delete saved chats. Options can differ by plan and workspace. Read the provider’s current documentation rather than relying on a screenshot or advice written for a different account.
Official reference: ChatGPT Data Controls. For API data practices, see OpenAI API data controls.
The CLEAR privacy workflow for everyday AI work
Use CLEAR before you paste, upload or connect anything. It is a practical checklist created for this guide—not a certification or formal security standard.
- C — Classify: Is the information public, internal, confidential, personal or highly sensitive?
- L — Limit: Remove everything the task does not need.
- E — Examine: Check the account, tool, data settings, connected apps and applicable agreements.
- A — Anonymise: Replace identifiers and generalise details where feasible; verify that the person or client cannot easily be inferred.
- R — Review: Before submitting and again before using the output, check for accidental disclosure, invented details and unsafe recommendations.
For a solo freelancer, this can take less than a minute for a routine, non-sensitive task. For a confidential client project, regulated records or a workflow that processes data at scale, the correct response may be to stop and obtain approval—not simply to complete the checklist faster.
Safer ways to use AI in common freelance and business tasks
Writing and editing
Use a fictional sample or remove customer identifiers before asking for a rewrite. Tell the model to preserve facts, flag unclear statements and never invent missing details. Review the final copy before sending it to a client.
Spreadsheet analysis
Start with aggregate totals or synthetic rows. Remove names, emails, account numbers and free-text notes. If the analysis genuinely requires identifiable data, use only an approved system and limit access to the people who need it.
Software development
Share a minimal reproducible example. Replace keys, database URLs, internal hostnames and customer data. Check your employer’s code-sharing policy and the licences of any code you include or accept.
Meeting summaries
Check whether participants were told about transcription or AI processing and whether your organisation permits the tool. If permission is uncertain, create your own notes and ask AI to structure a non-identifying summary.
Research and client deliverables
Do not confuse privacy with accuracy. Keep sensitive inputs out of unapproved tools, and separately verify claims and sources before publishing. Our guides on fact-checking AI answers with TRACE and building an AI workflow for freelancers explain those quality checks.
Copy-and-use AI privacy checklist
- ☐ I know which account and AI service I am using.
- ☐ The task does not require passwords, tokens or recovery secrets.
- ☐ I have removed unnecessary personal and confidential details.
- ☐ I have checked whether the client or organisation permits this tool.
- ☐ I understand the relevant data controls, sharing and retention terms.
- ☐ I have reviewed attachments, screenshots and connected-app permissions.
- ☐ I will review the output before sharing or acting on it.
- ☐ I know what to do if I accidentally disclose sensitive information.
Frequently asked questions
Is it safe to paste client information into ChatGPT?
There is no universal yes or no. It depends on the data, the account and product, your client agreement, your organisation’s policy and applicable obligations. Do not paste confidential or personal information into an unapproved tool. Use the minimum necessary information and an authorised workflow.
Does turning off model training mean my information is completely private?
No. Model-improvement settings address one specific use of eligible content. They do not automatically delete chats, remove all retention, satisfy confidentiality duties or guarantee that no processing occurs. Read the terms and controls for the exact service and account.
Can I anonymise a document by deleting the person’s name?
Not always. Addresses, dates, job roles, rare events and combinations of facts can re-identify someone. Remove unnecessary details and review the entire text and attachments before submitting them.
Can I use AI to summarise a contract or legal file?
Only when you are authorised to use the selected tool for that material and appropriate safeguards are in place. Do not treat the output as legal advice or as a substitute for a qualified professional’s review.
What should I do if I accidentally paste a secret into a chat?
Follow the relevant provider or organisation incident process. For passwords, tokens or keys, revoke or rotate them promptly where possible; review access logs if available; and notify the responsible security or client contact when required. Deleting the chat alone may not be enough.
Is using AI for work automatically a privacy violation?
No. Responsible use is possible when the tool, data, permissions and safeguards fit the task. The important habit is to classify information first rather than assume every tool or prompt is appropriate.
Final thought: make privacy part of the prompt
The most productive AI user is not the person who pastes the most information. It is the person who understands the task, shares only what is needed, verifies the tool and reviews the result. Build the habit now, and you can use AI more confidently without treating client trust as an afterthought.
Editorial note: This guide is general educational information, not legal, cybersecurity or compliance advice. Requirements differ by jurisdiction, contract, industry and service. When handling regulated or highly sensitive information, seek advice from the appropriate professional or security lead.
Image credits: Featured photograph by Lauren Sauder; portrait photograph by Noha Badawi, via Unsplash.