Data · Briefing

A plain guide to what your data exposes

Using AI tools means giving them information. That is the whole point, and it is also the risk. This guide is a plain look at what you are exposing, to whom, and what sensible habits look like for a small business. It is general information, not legal advice.

What "your data" actually includes

Most owners think of the customer list. It is wider than that.

• Customer details: names, contact details, addresses, anything personal.
• Financial information: prices, margins, supplier terms, invoices, bank details.
• Staff information: pay, performance, personal circumstances.
• Commercial secrets: your methods, pipeline, plans and contracts.
• Other people's information that you hold on their behalf.

When you paste any of it into a tool, you have shared it with whoever runs that tool.

What happens when you paste something in

It depends on the tool and on the plan you are using. Some tools keep what you send, some use it to improve their product unless you switch that off, some keep it only for a short time and some do not store it. The settings and the terms differ between free and business versions of the same product.

You cannot tell from the screen. You have to read the terms or ask. If you cannot find a clear answer, treat the tool as if it keeps everything.

The sensible habits

Decide what never goes in. Keep a short list: personal details of customers, health or financial identifiers, passwords and keys, anything covered by a confidentiality agreement.

Use business grade versions. Business plans usually give you clearer terms, control over retention and the ability to turn off training on your data. Free versions rarely do.

Share the least that does the job. If the task is to rewrite a reply, you do not need to include the customer's full details. Remove or replace what is not needed.

Keep passwords and keys out entirely. Never paste them into a tool, however convenient.

Give staff a one page rule. What is fine, what is not, who to ask. People make better choices when the rule is short and written down.

Questions to ask a supplier

• Where is our data stored, and in which country?
• Is it used to train anything, and can that be switched off?
• Who inside your company can see it?
• How long is it kept, and how do we have it deleted?
• What happens to it if we stop using you?
• Who do we contact if something goes wrong?

Customer information and the law

Depending on your size and what you hold, privacy law in Australia may apply to you, including what you may do with personal information and what you must do if it is lost. If you hold customer details, it is worth a short conversation with someone qualified about your obligations before you automate anything that touches them.

The safest data is the data a tool never saw.

When something goes wrong

Know in advance who decides, who is told and how you will find out what was exposed. A tool that keeps a record of what it accessed makes this far easier. If you cannot see what it did, you cannot say what it saw.

The short version

List what you hold, decide what never goes into a tool, use business grade versions, share the least you can and ask suppliers six plain questions. A written rule that fits on one page does more than a long policy nobody reads.