What to Share with AI, What Not to, and What Happens to Your Data When You Do
The road ahead is long and winding. The latest installment of our regular Driving Innovation series is once again steered by Jordan Goure, the man normally behind the wheel of the dynamic hiring platform Picsume. This issue, we’re discussing how to use artificial intelligence (AI) tools safely, so you can spend more time planning for positive outcomes and less time worry about bad ones.
The Big Idea: Data Privacy
We’re seduced by AI-powered chatbots like ChatGPT, Copilot, and Claude because using them feels like carrying on a productive conversation with a close confidant. Pasting a contract, password, or confidential client detail into a text-entry field feels private, safe, and natural. But is it?
According to Goure, engaging responsibly with AI tools requires simple common-sense safeguards.
“This isn’t about fear,” he explains. “I like to frame data privacy as one simple habit shift.”
As Goure relates, any reader of a certain age will recall learning not to blindly open a link in a suspicious-seeming email or text message. Over time, users will see their relationships with chatbots evolve in a similar way.
Your Chat History is Rarely History
Most AI tools keep a digital record of your conversations until you elect to delete them. “Even then,” cautions Goure, “some data may be retained longer in the background for safety review or—if you’ve opted in—to help improve the AI model.”
Goure recommends checking your preferred chatbot’s Privacy Settings menu. Most tools let you view or delete your personal history and toggle off something like “use my chats to improve the AI.”
That said, the degree to which you believe your conversations are gone forever depends on the degree to which you trust the company behind your conversation partner. Storing a complete history of a user’s simple text-based prompts is trivial, even at enormous scale, for the world-bestriding tech companies behind the most popular chatbots. It’s best to assume any information you volunteer to ChatGPT is effectively tucked away forever in Sam Altman’s office filing cabinet. “Deleted” might very well mean “stored” or “archived” rather than “destroyed.” Whether or not that matters depends in part on your own personal comfort level and risk tolerance and in part on the nature of the information you’ve shared.
The “Don’t Paste This” List
Goure believes all users should keep four categories of information far away from AI prompts:
- Credentials: e.g., passwords, API keys, two-factor authentication codes, answers to security questions
- Financial details: e.g., bank/credit card numbers, tax information
- Personal identifiers: e.g., social insurance/security numbers, scanned ID documents, medical information
- Confidential work materials: e.g., proprietary company information, internal documents, customer or employee data
Free vs. Paid: Can You Buy Privacy?
“Free consumer-level AI tools often use your chats to help improve the AI by default,” says Goure, who notes users can usually opt-out of this practice. “Paid versions of these tools, often pitched at business or enterprise clients, more regularly carry stricter privacy terms—but not always.”
According to Goure, it’s best not to generalize; different tools, free and paid alike, handle user data differently. As a rule, what you share matters more than on which plan you share it. The “Don’t Paste This” list applies either way.
The “Swap It Before You Send It” Trick
Trust this one simple, memorable rule when sensitive information is critical to the prompt you are writing: Replace anything specific with a placeholder. A real name becomes “my client,” and a real dollar figure becomes “$X,” a real company becomes “Company A.”
Sarah owes TD Bank $4,200 on invoice. #8834 →
My client owes the bank $X on an overdue invoice.
“If the sentence still makes sense with fake details,” says Jordan, “you didn’t need the real ones.”
When in Doubt, Don’t Paste
“Ask yourself, Would I be fine if this ended up somewhere I didn’t control?” poses Goure. “As long as you integrate this simple gut check into your workflow, you’ll be able to use AI freely for everything else.”
Goure’s company Picsume is a convenient exemplar of what an AI-positive, security-conscious operation can look like. According to Goure, Picsume keeps a job candidate’s identity (name, email, and phone number) locked away separately from everything else in their profile. “It’s like keeping someone’s name in a locked drawer while their resume sits on the desk in a folder labeled only with a number,” explains Goure. This deliberate organizational strategy means day-to-day client data like work history, skills, and activity information are never stored with a name attached. “It’s connected only by a random ID that means nothing on its own,” says Goure.
At any security-minded company, the same principle can apply whenever data moves between systems: only a meaningless ID travels—never personal details. Essentially, the lock is separated for the key as a matter of company policy.
Want to work like the best companies do? Plan for the worst-case scenario, use common sense, and follow the other tips and tricks in this article.
