What Data Should You Never Paste Into a Chatbot?
A plain-language red/yellow/green guide to chatbot data safety for households and small businesses — the same rules we use in every Privacy & Security Review.
4 min read · Mapleforge Labs
The rule in one sentence
Treat anything you paste into a consumer chatbot as if you were posting it on a notice board in the vendor's office: it may be stored, reviewed, or used to improve their models, and you cannot take it back. Business and enterprise tiers usually offer stronger guarantees — but only if you're actually on one, with the settings checked.
Red — never paste
Passwords, API keys, and recovery codes. Customer or patient lists with names and contact details. Unreleased financial statements and tax documents. Anything covered by an NDA you haven't checked for AI clauses. Children's records, grades, or health information. Photos of ID documents, contracts with signatures, or legal filings not yet public.
Yellow — transform first
Internal documents: strip names, account numbers, and addresses, and summarize instead of pasting whole files. Code: remove embedded credentials and connection strings. Emails: forward the substance, not the headers and signatures. When in doubt, ask whether the task still works with the sensitive parts replaced by placeholders — it usually does.
Green — and the setting that matters most
Public information, your own drafts, generic questions, and synthetic example data are safe territory. Then find the one setting that matters most on every account you use: whether your chats may be used for model training. Turn it off for anything work-related, or move work conversations to a business tier where 'no training on your data' is contractual, not a toggle. Our AI Privacy & Security Review (from $1,800) audits exactly this — data flows, vendor access, retention — and hands you the fixes in writing.
Want this applied to your organization?
Start with the free discovery call — or read about the services these guides come from.