Your customers' data isn't yours to give away.

To get useful drafts out of an AI you have to paste real things into it — real messages, real prices, real situations. That's the deal, and it's a fine deal. But there's a line, most people find it by crossing it, and nobody selling you AI tools is in a hurry to point at it.

This is the line. Five minutes, and it's the same advice I follow.

The short version

Paste the context. Withhold the identity and the credentials.

An AI needs to know what happened to draft a reply. It almost never needs to know exactly who it happened to, or anything that could be used against that person if it ended up somewhere else.

Keep it out — always

• Credentials. Passwords, API keys, tokens, recovery codes. Anything that grants access. If it's in a password manager, it doesn't go in a chat.
• Payment details. Card numbers, bank accounts, anything you'd cover with your hand at a café.
• Government identifiers. ID numbers, passport numbers, tax IDs.
• Health information. Yours, your staff's, your customers'. Different rules apply to it in most countries, and none of them contemplate a chat window.
• Other people's private contact details at scale. One customer's message with their name in it is one thing. Your whole contact list pasted in for "analysis" is another.

Think twice

• Names, phone numbers, addresses. Usually strip them. "A customer asked about a wedding cake for Saturday" drafts exactly as well as the version with her full name and number in it. Test: if this conversation appeared somewhere you didn't choose, would this person mind?
• Anything under an NDA or a client contract. You may have signed something that already answers this question. Go and read it.
• Your unreleased work. Not a privacy issue — a judgment one. Decide deliberately rather than by habit.
• Whole documents when a paragraph would do. Most people paste the entire file because it's easier. Paste the part that matters.

Fine to paste

• The message you're replying to, with the identifying details stripped.
• Your prices, policies, lead times, refund terms — you publish these anyway.
• How you talk. Examples of your own writing. That's the good stuff, and it's what makes drafts sound like you.
• The situation, described plainly.

What "trains on your data" actually means

This is where the confusion lives, so here's the plain version:

It varies by provider, by plan, and it changes. Consumer plans and business/API plans usually have different defaults. Some providers train on chat content by default and let you turn it off. Some don't train on business-tier data at all. Some retain conversations for a period even when they're not training on them.

I'm deliberately not listing "provider X does Y" here, because that would be out of date by the time you read it, and a confidently wrong answer about your customers' data is worse than no answer. That's the whole argument of this site, applied to itself.

Do this instead — once, today, five minutes:

1. Open your AI provider's settings and find the data controls. Read what the default actually is for your plan.
2. Turn training off if it's on and you'd rather it wasn't.
3. Find the retention policy. Know how long conversations stick around.
4. If you're handling other people's data seriously — health, finance, anything regulated — that's a conversation with someone qualified, not with me and not with a chat window.

Do it once, and then you're deciding instead of hoping.

If you already pasted something you shouldn't have

Don't panic, and don't pretend it didn't happen.

1. Delete the conversation if the provider lets you. It doesn't unring the bell, but it stops it being sitting there.
2. If it was a credential — a password, a key, a token — rotate it. Today. That's the one that actually matters, and it's about ten minutes of annoyance versus a real problem later.
3. Check your data settings so it doesn't happen by default again.
4. If it was someone else's data and there's a legal obligation attached, get proper advice. I'm not a lawyer and this page isn't legal advice.

The bit that generalises

The reason this is a five-minute page and not a policy document: you are the control. Not a setting, not a toggle, not a promise on a pricing page. You decide what goes in, the same way you decide what goes out.

That's the same discipline as the gate, pointed the other direction.