Is it safe to put my personal or work data into AI chatbots?

Assume anything you paste could be seen by a human reviewer or used to improve the model unless the provider explicitly says otherwise for your specific plan. That single assumption gets you to sensible behaviour without needing to read every privacy policy. What actually varies by product and plan: - **Consumer free/paid tiers** often use conversations for training by default, sometimes with an opt-out setting worth finding and turning off. - **Business, enterprise and API tiers** typically do not train on your data by contract, and often offer retention controls. This is the meaningful distinction, and it's why companies pay for them. - **Retention** is separate from training. Even with training off, conversations are usually stored for a period for abuse monitoring, and staff can access them under defined circumstances. What you should not paste into a consumer chatbot: 1. Customer or user personal data — names, emails, addresses, health or financial records. In many jurisdictions this isn't just unwise, it's a data protection violation, and 'I was using it to work faster' is not a defence. 2. Credentials, API keys, tokens, passwords, private keys. 3. Proprietary source code your employer owns, unless your company has approved a tool for it. Several large companies banned chatbots outright after employees pasted internal code, and 'was it actually leaked?' became unanswerable. 4. Confidential business information — unreleased plans, contracts, financials, anything under NDA. 5. Other people's private information. Your own risk is your choice; theirs isn't. What's fine: public information, your own writing you don't mind sharing, generic technical questions, code with no secrets or proprietary logic, and anything you'd be comfortable posting on a public forum. The practical middle path for work: - Check whether your employer has an approved tool. Many do now, precisely so people don't use consumer versions. - Redact before pasting. Replace real names, IDs and keys with placeholders. It usually takes thirty seconds and eliminates most of the risk while keeping the usefulness. - Describe the problem generically instead of pasting the artefact — often you get an equally good answer with none of the exposure. One organisational note worth raising if you're deciding policy: a blanket ban tends to produce shadow usage on personal accounts, which is strictly worse than an approved tool with a data agreement. The realistic goal is a sanctioned path, not abstinence.