AI privacy: what not to paste into a chatbot

AI data privacy comes down to one habit: assume anything you paste into a consumer chatbot could be stored, reviewed by the company, or used to train a future model, and never paste anything you would not be comfortable with a stranger reading. Three categories should never go in on a free or personal account: client identifying information, credentials like passwords and API keys, and unreleased financials. Everything else is a judgment call you make faster once you know the rule.

This is not paranoia about AI. It is the same instinct that keeps you from emailing a password or leaving a client contract on a coffee shop printer. The tools are new. The habit is old.

What should you never paste into a chatbot?

Some inputs are almost never worth the risk, whatever tool you are using. Memorize these three and you avoid the mistakes that create real damage.

• Client identifying information: names, addresses, emails, health details, anything that ties a real person to private facts. Their data is not yours to feed a model.
• Credentials and secrets: passwords, API keys, bank logins, two-factor codes. A chatbot is not a password manager and has no reason to see these.
• Unreleased financials: your revenue numbers, a client's books, deal terms, anything under NDA or not yet public. Once it is in a training set, you cannot pull it back.

Here is why these three specifically. It is not that the AI is malicious. It is that you lose control of the data the moment it leaves your machine, and these three categories are the ones where losing control costs the most.

Notice the safer moves are small. You are not giving up the tool. You are giving it less than it asked for and getting the same help.

Does a business or enterprise AI plan change the rules?

Somewhat, and it is worth understanding what changes conceptually so you do not over-trust a paid tier. The important shift on most business and enterprise plans is that the provider agrees not to train future models on your inputs, and often adds data controls and retention limits. That is a real upgrade. It moves your data from "possibly part of the next model" to "processed for you and then handled under an agreement."

What it does not do is make your data disappear. Your inputs still travel to a server, still get processed, and are still only as safe as that company's security and your own account. A business tier lowers the risk of your words showing up in someone else's answer. It does not turn a chatbot into a vault, and it does not cover a teammate who pastes a client's medical history into a personal account on the side.

So the mental model is simple. Business tiers change what the company can do with your data. They do not change the habit you should keep no matter the tier. Treat the three no-go categories as no-go on every plan, and treat everything else as fair game once you have removed what does not need to be there.

What is the redact-then-prompt habit?

The whole practice fits in one move you do before you hit enter. I call it redact then prompt, and once it is a habit it costs you about ten seconds.

The insight that makes this work: the AI almost never needs the sensitive part to do the job. It needs the shape of the task, not the private specifics. A cease-and-desist to "the vendor" reads the same as one to a named company. A cash-flow model built on stand-in numbers has the same structure as one on your real numbers. You paste the structure, keep the secrets, and reassemble at the end.

How does the redact-then-prompt habit look in practice?

A bookkeeper I'll call Renata does month-end summaries for eight small-business clients. She wanted AI to turn her raw notes into clean client-ready recaps, which is a genuinely good use. Her first instinct was to paste a full ledger in. That ledger had client names, account balances, and vendor payments on it. All three no-go categories in one document.

Instead she built a five-minute redact step. She replaced each client's name with "Client A," swapped exact balances for rounded stand-ins, and stripped the vendor list down to categories like "software" and "contractors." Then she prompted.

You are my bookkeeping assistant. Here are this month's notes for Client A, using rounded numbers: [paste redacted notes]. Write a clear, friendly one-page summary a non-financial owner can understand. Flag anything that looks unusual.

The AI wrote a clean summary in seconds. Renata dropped the real name and exact figures back in, checked it, and sent it. The client got a polished recap and never had their private numbers sitting on a server they did not choose.

She kept most of the time savings and gave up none of her clients' privacy. That is the trade the habit buys you.

What about the rest of your prompts?

Not everything needs redacting, and treating every prompt like a state secret will burn you out. The three no-go categories are strict. Beyond them, use a simple gut check: would you be fine with this input showing up in a screenshot someday. If yes, prompt freely. If it makes you wince, redact first.

This pairs naturally with giving the AI good non-sensitive context, which is a skill of its own. There is more on that in how to give AI the right context, and if you want the wider picture of designing AI use around the people it affects, human-centered AI covers it. For a full one-page set of team rules that includes a data section like this, a responsible AI policy your team can copy is the companion piece.

If you would rather work inside tools already set up with sane data defaults and prompt templates that assume redaction, the prompt packs and trainings in the WorkSmart OS are built for exactly this kind of safe, repeatable use.

The AI needs the shape of your problem, not the name attached to it.

Do this next

Pick the one AI task you do most and write down which of the three no-go categories tends to sneak into it, then build a ten-second redact step for that task and use it every time. That single habit closes most of your privacy risk. The WorkSmart OS gives you prompt packs and templates that already assume you are working with stand-ins, so safe prompting becomes your default instead of a thing you remember to do.