AI tools are becoming part of everyday work.
People use them to write emails, summarize documents, analyze information, generate images, solve problems, and even handle parts of their business.
But there is one habit every AI user should develop:
Think before you paste.
An AI tool may be incredibly useful, but that doesn’t mean every piece of information belongs in a chat box.
Different AI services have different privacy policies, data controls, retention periods, and account settings. Some may allow submitted content to be used to improve their models, depending on the service and your settings. NIST also identifies privacy and sensitive-information exposure as important risks associated with generative AI.
So what should you keep out of AI tools?
1. Passwords and Login Credentials
Never paste your:
- Passwords
- PINs
- One-time passwords
- Recovery codes
- Security questions and answers
- Authentication tokens
AI can help you troubleshoot a login problem without seeing the actual password.
Instead of:
“Why isn’t my password working? Here’s my password…”
Say:
“I’m getting an authentication error when logging into my account. What could cause it?”
You can explain the problem without exposing the secret.
2. Bank and Card Details
Don’t paste:
- Full card numbers
- CVV codes
- Bank login details
- PINs
- Account security information
- Payment authentication codes
If you need help understanding a financial document, remove sensitive account information first.
3. Identity Documents
Be careful with passports, driver’s licences, national identity cards, certificates, and similar documents.
These can contain combinations of information that are useful for identity theft or impersonation.
If an AI tool needs to help you understand a document, consider removing information such as:
Full name + ID number + address + date of birth + document number
when those details aren’t necessary for the task.
4. API Keys and Security Credentials
If you’re a developer, this one is especially important.
Never paste:
- API keys
- Secret keys
- Access tokens
- Private keys
- Database credentials
- Cloud credentials
If you’ve accidentally exposed a secret, don’t simply delete the message and assume the problem is solved.
Revoke or rotate the credential.
5. Confidential Business Information
AI can be useful for business analysis, but don’t casually paste confidential company information into a consumer AI service.
This could include:
- Unreleased financial results
- Internal strategies
- Acquisition plans
- Confidential contracts
- Pricing strategies
- Trade secrets
- Product roadmaps
- Internal reports
If the information would cause a serious problem if it appeared outside your organization, think carefully before putting it into an AI tool.
6. Customer or Client Information
Be particularly careful with information belonging to other people.
Don’t casually upload customer databases, private conversations, contact lists, invoices, or documents containing personally identifiable information.
Ask yourself:
Do I have permission to put this person’s information into this service?
That’s an important question, especially when you’re using AI for work.
7. Private Conversations
You might be tempted to paste an entire WhatsApp conversation, email thread, or private message into AI and ask for an analysis.
Sometimes that’s useful.
But remove unnecessary identifying information first.
You can replace:
“John Smith from ABC Company said…”
with:
“A client said…”
You often don’t need someone’s real identity to get useful AI assistance.
8. Highly Sensitive Personal Information
Think carefully before sharing information about:
- Your health
- Your finances
- Your relationships
- Legal problems
- Family matters
- Personal conflicts
- Other sensitive circumstances
There are legitimate reasons to use AI to understand or organize sensitive information, but don’t assume every AI service handles such information in exactly the same way.
Check the service’s privacy settings and policies first.
9. Private Photos and Videos
Before uploading a personal photo, consider what else might be contained in it.
A photograph could reveal:
- Your location
- Your home
- Children or other people
- Identification documents
- Vehicle information
- Personal belongings
- Sensitive surroundings
The same applies to videos and screen recordings.
Sometimes the background contains more private information than the thing you’re actually asking the AI about.
10. Information That Belongs to Someone Else
This is easy to overlook.
Just because you have someone’s information doesn’t necessarily mean you should upload it to an AI service.
Think about:
- Your friend’s private message
- An employee’s personal information
- A customer’s complaint
- A colleague’s confidential document
- Someone else’s photograph
Your access to information isn’t automatically permission to share it with an AI tool.
So, What Can You Share?
The answer isn’t “nothing.”
AI becomes much less useful if you’re afraid to give it any context.
The goal is to share only what the AI needs to complete the task.
For example, instead of uploading an entire confidential document, you might provide a short, anonymized section.
Instead of sharing a customer’s full details, replace identifying information with placeholders.
Instead of giving AI your company’s internal numbers, you might use fictional numbers to test a formula or workflow.
This principle is simple:
Give AI the minimum information necessary to do the job.
Check Your AI Tool’s Privacy Settings
Don’t assume every AI service handles your data in the same way.
Check:
- Whether your conversations can be used to improve models
- How long chats are retained
- Whether uploaded files are stored
- Whether third-party services receive your information
- What privacy controls are available
- Whether your organization has additional policies
For example, ChatGPT provides Data Controls that let eligible personal users choose whether new conversations help improve models. Temporary Chat also has different history, memory, model-improvement, and retention behavior. Business and API offerings have different default data-use policies.
The important point isn’t to memorize one company’s settings.
It’s to check the settings of the tool you’re actually using.
The “Before You Paste” Test
Before putting something sensitive into an AI tool, ask yourself five questions:
1. Does the AI actually need this information?
If not, remove it.
2. Can I anonymize it?
Replace names, numbers, addresses, and other identifiers.
3. Would I be comfortable if this information were exposed?
If the answer is no, think twice.
4. Have I checked the tool’s privacy policy and settings?
Don’t guess how your data is handled.
5. Does someone else’s privacy depend on this?
If yes, be even more careful.
AI Should Make Your Work Easier, Not Make You Careless
The point isn’t to be afraid of AI.
AI can be incredibly useful, and privacy controls are improving across many services.
But convenience can make people careless.
When an AI tool says, “Paste the document here,” you don’t have to paste everything.
When it asks for context, you don’t have to provide someone’s private information.
And when you’re dealing with something sensitive, you should understand where that information is going and how the service handles it.
The safest AI habit is simple:
Share less. Anonymize when possible. Check your settings. Think before you paste.
That’s usually enough to make AI a much more useful tool without unnecessarily giving away information that should have stayed private.
Frequently Asked Questions
Can I use AI with personal information?
Sometimes, but it depends on the information, the AI service, your account type, and the service’s privacy controls. When possible, remove unnecessary identifying information.
Should I upload confidential business documents to AI?
Only when your organization’s policies and the AI service’s data-handling terms allow it. For sensitive material, use an approved business or enterprise solution where appropriate.
Is Temporary Chat completely private?
Not necessarily. For example, OpenAI says Temporary Chats aren’t used to improve its models while they remain temporary and don’t appear in chat history, but a copy may be retained for up to 30 days for safety purposes.
What is the safest thing to do before uploading a document?
Remove information that isn’t necessary for the task, especially passwords, identification numbers, financial information, personal details, and confidential information belonging to other people.
Should I delete an AI chat after sharing sensitive information?
Deletion and privacy controls depend on the service. Don’t rely on deletion as your only protection. The better approach is to avoid unnecessarily sharing sensitive information in the first place.