People want to use AI to move faster, then quietly worry they have just broken a privacy policy. Here is what is actually happening to the text you paste in, and how to use it safely.
This is not a hypothetical worry. If you paste a client's name, a contract clause, or unreleased pricing into a free chatbot, that text has left your business and gone to a third party's servers. What happens to it after that depends entirely on which tool you used and what account it was on, and most people using AI at work have never checked.
Free and personal paid plans on most AI chat tools have a training toggle in account settings, and it is often switched on unless you go in and turn it off yourself. Business, team and enterprise plans from the same providers generally do not train on your data by default, and come with a written agreement that says so. The tool name is not the deciding factor. The plan you are on, and the setting inside it, are what actually matter, so check both rather than assuming.
If nobody in your business has checked which plan is being used, or whether training on inputs has been switched off, that is the actual gap. It is usually a five minute fix, not a reason to ban AI outright.
Before pasting something in, ask whether you would be comfortable if that exact text appeared in a support ticket read by a stranger at the AI company. Public information, general questions, drafting help and your own writing are almost always fine. Client names attached to sensitive details, unreleased financial figures, medical information, and anything with a confidentiality clause attached are not, unless you are on a plan built for that and your business has actually reviewed the terms.
A written one page policy beats an unofficial ban that everyone quietly ignores. A workable one usually covers three things: which tools and plans staff are approved to use, a plain list of what should never be pasted in regardless of the tool, and who to ask when someone is not sure. Most small businesses do not need a lawyer to write this. A clear page that staff have actually read does more good than a long document nobody opens.
If your business handles client records, health information, or anything with genuine confidentiality obligations, and staff need an AI assistant that works on that material every day, the honest answer moves past "check your settings." That is a case for a properly scoped assistant with access controls and a clear answer about where the data lives, not a general chatbot on a business plan. It is a real build, and worth getting a scope for rather than guessing.
Written by the AI Builds team. AI Builds is operated by Media Mantra, ABN 89 594 851 152. This is general information, not legal advice on your privacy obligations.
She checks the job, writes the scope, and never sells you a build.