Privacy: what not to paste into a chatbot

It's 6 p.m., and an accountant wants to reword a delicate email to a client in difficulty. She copies the whole exchange into a chatbot: the company name, the manager's name, the amount of the debt, the IBAN in the signature. The answer is excellent. The problem comes before the answer: that information has left her computer and landed on a third party's servers, under terms she may never have read.

Rewording that email was possible without handing over any of this, with ten seconds of preparation. Here's how to think about it, bearing in mind that there's no single rule: it all depends on the tool, your plan, your settings, and the type of data. What follows gives general guideposts, not legal advice.

What can happen to your text once it's sent

When you send a message, it's processed by the provider's servers, unless you use a model installed on your own machine. From there, several things can happen depending on the tool and the contract:

• the conversation is stored, for a period set by the provider;
• it may be used to train future models, unless you opt out or your plan rules it out;
• authorized people can sometimes view it, for example to handle abuse or assess quality;
• it may be accessible to anyone using your account, or shared by mistake if you create a public link.

These terms change, and they differ from one product to another. Only one habit holds up over time: assume that any text you send is out of your control, unless you've checked otherwise in your tool's settings and terms.

The risk exists even for the best-equipped companies. In 2023, the press reported that Samsung had restricted internal use of these tools after employees pasted confidential code into them.

The list to keep in mind before you paste

By default, keep the following out of a consumer chatbot, unless your organization has approved a suitable tool and framework.

Credentials and secrets. Passwords, API keys, access tokens, configuration files. For a developer, this is the most common trap: you paste a file to debug and the key goes with it. If that happens to you, consider the secret compromised and change it.

Third parties' personal data. Names, addresses, phone numbers, emails, social security numbers, bank details of customers, employees, students, or members. A teacher doesn't need a student's name to prepare a report card comment.

Sensitive data. Health, political opinions, religion, sexual orientation, origin, union membership: the GDPR protects them more strictly. Extra caution applies doubly to data concerning minors.

Anything covered by professional secrecy. Doctors, lawyers, chartered accountants, and other professions have obligations of their own. Before any use on real files, ask your professional body or council.

What you're not allowed to disclose. Documents under a confidentiality agreement, unpublished financial results, contracts, acquisition plans, proprietary code, strategic data.

For your own personal data, the decision is yours, but think about what comes next: what you entrust to an online service can resurface in the event of a leak.

Three settings to check in your tool

Spend five minutes on these checks. The location of the options changes often; look in the "privacy" or "data" settings, and read the tool's terms if in doubt.

Don't infer anything from the price: a paid individual plan doesn't necessarily behave like an enterprise plan. And a setting turned off doesn't necessarily delete what has already been sent. Also check where the data goes if you enable connectors or extensions: a tool linked to your email or your drive sees far more than what you paste.

Masking data: the good practice, and its limits

Most of the time, the chatbot doesn't need to know who the people are; it only needs to understand the situation. Replace identifying elements with neutral placeholders.

Here's the risky version, on a fictional case:

Reword this email for Jean Dupont, manager of the Dupont bakery in Dole, who has owed us €12,430 since March and who has health problems.

And the version that does the same job:

I'm a [PROFESSION] and I need to follow up with a client with whom I want to keep a good relationship. The client, whom I'll call Client A, is a small business. They're several months behind on payment and going through a difficult personal time, which I don't want to mention directly.

Here is my draft, with the names replaced by placeholders:
"""
[DRAFT WITHOUT NAMES, ADDRESSES, IBAN, OR EXACT AMOUNTS]
"""

Reword this message so it's firm about payment and human in tone, in under 120 words. Suggest a payment schedule in the form of an open question. Leave the placeholders as they are so I can replace them afterward.

You put the real names back in your email software, outside the chatbot. If you make this kind of request often, build these placeholders into your reusable prompt templates and your prompts for professional emails.

This masking has a limit. Replacing a name with "Client A" doesn't always make the person impossible to recognize: the combination of a rare profession, a city, and an event can be enough. The CNIL, for that matter, distinguishes anonymization, which makes identification impossible in practice, from pseudonymization, and data that is merely pseudonymized remains personal data. So strip out the details unrelated to your question, and keep the ones the model really needs.

For a long document, the exercise is heavier. Before following our method for working with long documents, ask yourself whether a cleaned-up excerpt wouldn't be enough. And don't count on the chatbot itself to anonymize a sensitive file: you'd have to send it the file first.

At work: what changes when the tool isn't only yours

In an organization, the decision isn't yours alone. Your uses commit your employer, sometimes under the GDPR. First check whether there's a policy or a list of authorized tools. If there isn't, ask the data protection officer, management, or the IT department before putting real data in.

For an association or a small organization without a legal department, the CNIL has published questions and answers on the use of generative AI systems. Among other things, it recommends starting from an identified need, setting out uses in writing, and training the people concerned. It also reminds readers to enter only information they're authorized to share, and to avoid personal and confidential data. This document can be found on cnil.fr: search for "questions-réponses IA générative." If in doubt about a specific case, contact the CNIL or a legal professional.

One option can complement this framework: running a model on your own machine or with a hosting provider you choose. The data then no longer passes through a consumer service, but configuration, security, and the quality of the answers become your business.

Before you close this tab

Open your chatbot's settings and find the option concerning training on your conversations. Decide whether it should stay on. Then look through your history for the last conversation where you pasted something sensitive, and check whether it should be deleted, keeping in mind that deletion on the server side follows the provider's rules.