Skip to content
High Basin Solutions

GUIDE · AI SAFETY

Is it safe to put client data into ChatGPT?

A plain-English guide for small businesses: what happens to what you type into ChatGPT and similar tools, what should never go in, and how to set up AI so your team can use it safely.

By Aaron Tibbitts, High Basin Solutions · · 5 min read

THE SHORT ANSWER

Not in a free or personal account. What you type can be stored by the provider and, on many consumer plans, used to improve its models. Keep names with birth dates, health details, financial account numbers, and anything confidential out of free chat tools. With a business plan, the right settings, and identifying details removed, AI is much safer to use with real work.

What happens to what you type

When someone on your team pastes a client email into ChatGPT, Gemini, Claude, or Copilot, that text is sent to the provider's servers to be processed. What happens next depends on the plan and the settings:

  • It may be kept. Conversations are usually saved to the account's history, and providers keep data for a period of time for safety and legal reasons.
  • It may be used for training. On many consumer plans, conversations can be used to improve future models unless someone turns that setting off. Business plans generally say they don't do this by default.
  • It may be seen by people. Providers can review conversations, for example to investigate abuse. Treat a chat window like an email to an outside company, not like a private notebook.

None of this means AI tools are reckless. It means the same rule applies as with any outside service: only send what you'd be comfortable with that company holding.

What should never go into a free AI tool

Keep it out

  • Don't paste: Full names together with dates of birth, Social Security numbers, or driver's license numbers
  • Don't paste: Health or medical details about a customer, patient, or employee
  • Don't paste: Bank, card, or account numbers, and client financial statements with names attached
  • Don't paste: Passwords, API keys, or login links
  • Don't paste: Anything a client contract or confidentiality agreement says you'll keep private

Usually fine

  • Drafting a general email or announcement
  • Rewording your own website or marketing copy
  • Summarizing a public article or document
  • Brainstorming ideas, outlines, or checklists
  • Questions with the identifying details removed, like "a client" instead of a name

If you work in a field with its own rules, like healthcare, accounting, legal, or finance, those rules apply to AI tools too. When in doubt, ask whoever handles compliance for your business before using AI with client information.

Five steps to use AI safely with real work

  1. 01

    Use a business plan, not personal accounts

    Most AI providers offer business or team plans with stronger data controls, and they say those plans don't use your conversations to train their models by default. Personal free accounts usually give you fewer guarantees.

  2. 02

    Check the data settings

    Look for settings about chat history, data retention, and whether conversations are used to improve the model. Turn off anything you don't need, and check again after big product updates, since settings and policies change.

  3. 03

    Strip identifying details first

    Replace names, dates of birth, and account numbers with placeholders like [client] or [account] before pasting. The AI rarely needs them to do the job.

  4. 04

    Write a one-page AI rule for your team

    List which tools are approved, what never goes in, and who to ask when unsure. A short rule people actually remember beats a long policy nobody reads.

  5. 05

    Keep a person in the loop

    AI can sound confident and still be wrong. Anything that goes to a client, like an email, a number, or advice, should be read by a person first.

An example

A front-desk employee wants help writing a payment reminder. Here's the same request two ways:

RISKY

“Write a reminder to Dana Reyes, DOB 03/14/1988, about her overdue $1,840 balance on account 44-1029.”

SAFER

“Write a friendly reminder to [client] about an overdue [balance]. Keep it short and polite.”

The AI writes the same email either way. The employee fills in the details afterward, in your own system. (The example is made up.)

The bottom line

AI tools can save a small business real time, and they don't have to be a privacy risk. Use business accounts, check the settings, keep identifying details out, and have a person review anything that reaches a client. Provider policies change, so it's worth checking your tools' current data settings every few months.

This guide is general information, not legal or compliance advice. Check your AI provider's current terms and any rules that apply to your industry.