What should you never paste into an AI tool?

Why this matters

With most AI chat tools, what you type is sent to the provider's systems to produce a reply. Depending on the tool, plan and settings, chats may be stored, reviewed by people or used to improve the provider's AI. That is not a reason to avoid AI. It is a reason to know the rules of the tool you use.

What the providers themselves say

Here is what one major provider states in its own documentation, as of October 2026. Settings change, so check the current page for your tool.

Google's Gemini apps. Google's privacy hub says human reviewers, including trained reviewers from its service providers, review some of the data it collects, including chats, to help improve its services [1]. It asks users directly not to enter confidential information they would not want a reviewer to see or Google to use to improve its services [1]. Turning off the "Keep Activity" setting stops future chats from being reviewed to improve Google services, and temporary chats are not used to train Google's AI models [1]. Even then, Google says it keeps those chats for up to 72 hours to respond to you and for safety [1]. If you use a work or school Google account, different data terms may apply [1].

Other providers publish their own data settings, and the same company can handle data differently by product, plan and setting. If you use a work account or a business plan, read the data terms for that exact plan, not just the personal version. Never assume. Check.

The never-paste list

These should not go into a general AI chat tool, whatever the settings:

• Passwords, PINs and security codes, including one-time login codes.
• Account and card numbers, bank details and payment information.
• Social Security numbers and other government ID numbers.
• API keys, access tokens and private keys for your software and services.
• Anything you are legally or contractually bound to keep confidential, such as information under a non-disclosure agreement.

The Federal Trade Commission's data security guide for businesses points out that Social Security numbers, card and financial details are what thieves use most often for fraud and identity theft [2]. Keep them out of places they do not need to be.

Handle with care

These may be fine in an approved business tool with the right settings, but think before you paste:

• Customer details: names, phone numbers, addresses, email threads, purchase history.
• Employee information: pay, reviews, disciplinary notes, personal situations.
• Business secrets: pricing strategy, unreleased plans, financials, contracts.

The FTC's guide recommends two habits that apply well here: know what personal information you have, and keep only what you need [2]. Ask: does the tool need this detail to do the job? Usually it does not.

Remove details before you paste

Before pasting a customer email to draft a reply, replace the name with "the customer" and remove the phone number and address. Before asking for help with a contract clause, remove the other party's name and the dollar figures. You get the same help without sharing what you do not need to.

NIST, the U.S. standards agency, lists data privacy as one of the key risks of generative AI, including leakage and unauthorized disclosure of personal information [3]. Removing details is a simple protection.

Set a simple rule for everyone

If others in your business use AI tools, write down one short policy: which tools are approved, which settings must be on, and what never gets pasted. The FTC guide recommends giving each employee access only to the information they need for their job [2]. A one-page rule, explained in five minutes, goes a long way.

Common mistakes

Pasting a whole email thread. Threads often carry signatures, phone numbers and other people's details. Copy only the part you need.

Assuming business and personal accounts work the same way. Data terms often differ by plan. Check the one you are using.

Sharing login details so an AI tool can "do it for you." Never give a chat tool your passwords.

Worked example

A property manager wants help replying to a tenant's complaint about a late repair. The email includes the tenant's name, unit, phone number and a payment dispute.

Before pasting, she rewrites it: "A tenant says a repair request from two weeks ago has not been completed and is frustrated. Draft a calm, professional reply that apologizes for the delay, confirms we will schedule the repair this week and gives a way to reach us." No name, no unit, no phone number, no payment details.

She adds the tenant's name and the specific date herself, in her own email program, and sends it. The tool did the writing. The personal details never left her inbox.

Checklist

• I have read the data settings for every AI tool I use for work.
• I never paste passwords, account numbers, ID numbers, keys or card details.
• I remove names, contact details and figures before pasting when they are not needed.
• I know whether my plan's chats are stored, reviewed or used for training.
• Anyone else using AI in my business knows the approved tools and the never-paste list.

Try it

Open the settings or privacy page of the AI tool you use most. Find three answers: Are my chats stored, and for how long? Can people at the provider review them? Are they used to improve the AI, and can I turn that off? Then write your own one-page "never paste" rule.

Tips

• If you would not email it to a stranger, do not paste it into an AI chat.
• Replace names and numbers with placeholders like "the customer" or "[amount]."
• Check settings again whenever you change plans or tools.
• Add your personal details back in your own email or document, not in the chat.

Sources

1. Google, "Gemini Apps Privacy Hub," Gemini Apps Help, last updated September 24, 2026, https://support.google.com/gemini/answer/13594961
2. Federal Trade Commission, "Protecting Personal Information: A Guide for Business," https://www.ftc.gov/business-guidance/resources/protecting-personal-information-guide-business
3. National Institute of Standards and Technology, "Artificial Intelligence Risk Management Framework: Generative Artificial Intelligence Profile," NIST AI 600-1, July 2024, https://nvlpubs.nist.gov/nistpubs/ai/NIST.AI.600-1.pdf