Privacy considerations
What actually happens to pasted text, the four data classes you must treat differently, and redaction habits that take seconds.
Every prompt you send to a cloud AI tool travels to the provider's servers, gets processed there, and is retained according to their policy and your plan. That single fact drives every privacy rule your company has — so let's make it concrete.
Consumer vs. enterprise: the split that matters
Consumer tiers — free or paid personal accounts — often reserve the right to use your conversations to improve their models, and retention is provider-controlled. Business/enterprise tiers typically contract the opposite: no training on your data, defined retention, admin controls, and compliance certifications. Same underlying model — completely different data posture. Know which one you're typing into; if your company provides an enterprise workspace, that's the one for work content.
The four data classes
- Public (published pages, press releases, public docs) — paste freely.
- Internal (process docs, drafts, non-sensitive plans) — fine on company-approved tools; check policy on personal accounts.
- Confidential (financials, strategy, unreleased products, customer lists) — approved enterprise tools only, and only when the task needs it.
- Regulated (health records, payment data, personal data under GDPR/CCPA, anything under NDA) — assume no unless your company has explicitly approved a tool for this class in writing.
Redaction: the 20-second habit
Most tasks don't need the sensitive bits, so the rule is: redact by hand first, before anything leaves your machine. Replace names with roles, account numbers with placeholders, amounts with rounded figures. One worked example: "Maria Torres, order #48512, is disputing a $1,340 refund" becomes "[CUSTOMER], order [ORDER-ID], is disputing a refund of roughly [AMOUNT]". The model drafts exactly as well against the placeholders — output quality is identical and the risk drops to near zero.
Then, for the gray zone only — a document you've already hand-redacted but that might still carry something you missed — you can use the model itself as a second pass:
I'm about to send you a workplace document to work on. I've already redacted the obvious identifiers by hand. Act as a second-pass privacy screen: list anything remaining that a cautious company would consider sensitive (names, identifiers, amounts, health or legal details), and show me a version with placeholders like [CUSTOMER], [AMOUNT], [ORDER-ID]. Don't do the task yet. Document: [paste]
The order matters: hand-redaction leads, always — never rely on the model to catch what you already know is sensitive. This second pass exists to catch the gray-zone details you'd miss, not to do the redaction for you.
Before pasting, ask: would I be comfortable if this exact text appeared in a vendor's logs, subpoenaed, with my name on the request? If you hesitate, redact or don't paste. This one heuristic replaces most of the policy manual.