Two different worries sit behind this question. One is about chat tools: staff pasting a customer list into a free account. The other is about built systems: something with a login to your email or your ERP.
The answers are different, and both come down to things you can check.
AI data privacy: is it safe to put business data into a chat tool?
It depends on the kind of account. OpenAI, Anthropic and Google each treat free or personal accounts and business accounts differently, and their own pages say so.
| Provider | Free or personal account | Business plan or paid developer account |
|---|---|---|
| OpenAI (ChatGPT) | Content may be used to train its models. Each user can turn this off in the data controls. | Not used to improve its models by default. This covers ChatGPT Business, Enterprise, Edu and the API. |
| Anthropic (Claude) | Chats are used to improve its models if the user allows it in the privacy settings. Chats flagged for safety review, and chats the user rates with a thumbs up or down, can also be used. | Not used to train its models by default. This covers Claude for Work and the API. |
| Google (Gemini) | In the Gemini app, chats can be used to improve Google’s services, and human reviewers read some of them. Google says not to enter confidential information. A setting in Gemini Apps Activity controls whether your data is used to improve Google AI. The unpaid tier of the Gemini API also uses content to improve Google’s products. | Gemini in Google Workspace does not use customer data to train models without permission. The paid Gemini API does not use prompts or responses to improve Google’s products. |
These are the providers’ own statements as we read them on October 7, 2026, and the links are at the end of this page. Policies change, so read the provider’s page before you rely on it.
For an office, the practical step is to put staff on a business plan and tell them not to use personal accounts for company work.
What should staff never paste into a personal AI account?
Anything you would not email to a stranger. Five kinds of information come up most:
- Passwords, keys and login codes.
- Card and bank account numbers.
- Customers’ personal details.
- Payroll, health and other staff records.
- Contracts and anything you have agreed to keep confidential.
What six questions should you ask before a system touches your data?
These are for anyone building or selling you an AI system. Each has an answer you can verify.
| Ask | The answer to expect |
|---|---|
| 1. Which AI provider processes our data, and on what kind of account? | A named provider and a business or developer account, in your company’s name. |
| 2. Is our data used to train anyone’s models? | No, with a link to the provider’s own terms that says so. |
| 3. What exactly can the system reach? | Only what the job needs, and read-only wherever it does not have to write. |
| 4. Where is our data stored, and for how long? | A named place you control, a stated period, and a way to delete it. |
| 5. Which people can see it? | Named people. The builder’s access is reduced once the system is running. |
| 6. What can the system do without a person’s approval? | Nothing that spends money or sends information outside the company. |
If a builder cannot answer the first two, ask them to find out before any work starts.
Is it safe to give an AI system access to your email?
It is safer when the access is narrow. Email access comes in levels, and many jobs need only the lowest one.
A system that finds documents in a mailbox needs to read. It does not need to send, delete or change settings. Ask for read-only access, and ask whether it can be limited to one folder or one label. If the system must send replies, have it prepare drafts that a person sends.
How does business data get out?
In four ways, and the six questions above cover each of them.
- The wrong account. A system or a staff member running on personal terms, where content may be used for training.
- Too much access. A login that can do everything, used for a job that only reads.
- Instructions hidden in what it reads. An email or a document can contain text written to trick an AI system into doing something. A person’s approval on risky steps is one defense.
- Records nobody looks after. Copies of your data kept in logs long after they were needed.
To go through the six questions for a system you are considering, book a 30-minute call. Airu Labs builds custom AI systems for small and mid-size companies, wired into the software they already use. Two of our builds show narrow access in practice: the claim assistant reads Gmail and cannot write to it, and the purchasing system writes a purchase order into the ERP only after the owner approves it.
How we handle your data
- The client owns the code and the accounts the system runs on.
- Read-only access where the job allows it (the claims system reads Gmail read-only).
- Nothing is ordered or written back until a person approves it: customers confirm their order; the owner approves the buy list before the purchase order goes into the ERP.