Is ChatGPT safe for your business data? What to paste, what not to, and the settings to change

The short answer

Yes, it's safe enough for most tradie admin, if you (1) leave out private details, (2) change one or two settings, and (3) check what comes back.

The risk isn't hackers reading your quote. It's (a) your chats being kept and possibly used to train the AI, (b) someone else getting into your account, and (c) you breaking privacy rules by sharing customer info you shouldn't.

Personal information means anything that tells you who someone is: name, address, phone, email, photo of a person, rego, even a job note that clearly points to one house.

The rules in plain English (NZ and AU)

**New Zealand: Privacy Act 2020.** It applies to every business, whatever its size — sole traders included. There is no small-business exemption. The Privacy Commissioner says the Privacy Act applies to AI tools, including overseas ones. The rules are 13 Information Privacy Principles (IPPs). The ones that matter most here:

• Collect only what you need, for a reason (IPP1). Tell people why you're collecting it (IPP3).
• Keep it safe (IPP5). The OPC says this covers what you type into AI. Its advice, in short: if in doubt, don't put personal information into AI tools.
• Check it's accurate before you use it (IPP8). AI can get details wrong.
• Use it only for the reason you got it (IPP10). Be careful sharing it, including overseas (IPP11, IPP12).
• From 1 May 2026, IPP3A covers telling people when you get their info from someone else (verify how it applies to your situation).

Australia: Privacy Act 1988 and the APPs

Most small businesses with annual turnover of $3 million or less aren't covered by the Privacy Act. But some are, whatever their turnover (for example health service providers, businesses that trade in personal information, and other listed cases). Check with the OAIC's small-business questionnaire on oaic.gov.au.

Even if you're exempt, the OAIC recommends protecting personal information as best practice, and you can opt in. Customers and bigger clients (builders, councils, property managers) may expect careful handling in contracts anyway.

OAIC AI guidance (verify current wording): do your homework on an AI product before using it, keep a human checking the output, and be careful entering personal information into publicly available AI tools.

APPs most relevant here: APP 1 (have a privacy policy), APP 6 (use/disclose only for the purpose), APP 8 (sending overseas), APP 10 (accuracy), APP 11 (security).

Privacy law in Australia is being updated and the small-business exemption is under review (verify current status). Sources: oaic.gov.au small business pages and OAIC guidance on commercially available AI products.

🟢 Green: fine to paste

Green means fine to paste into AI for most admin work:

• Your own wording: draft quotes with no customer details, scopes, job notes using first name + suburb
• Generic questions ("how do I explain a hot-water cylinder replacement simply?")
• Your price list and standard terms (your own info — see Amber for confidential supplier pricing)
• Public info: your website text, public reviews (you can remove the reviewer's name)
• Rough job descriptions: "3-bed in Papakura, leaking shower mixer"

🟠 Amber: strip it down first, or use a business plan

• Customer emails or texts (remove surname, phone, email, street number first)
• Photos of jobs (crop out house numbers, faces, number plates, family photos on walls)
• Supplier invoices and trade pricing under an NDA or trade account terms
• Staff rosters or timesheets (first names only)
• Contract clauses for a plain-English explainer (remove party names)

🔴 Red: never paste

• Bank details, card numbers, IRD numbers (NZ) or TFNs (AU), driver licence or passport numbers
• Passwords, login codes, alarm codes, key-safe codes, gate codes
• Health info about customers or staff (e.g. "elderly client with dementia, key under mat")
• Anything a customer told you in confidence, disputes and legal letters with names in them
• Full customer lists or exported spreadsheets from Xero/MYOB/your job app

⚠️ Red — never paste these into AI. Not into free apps, not into paid personal plans, not "just this once".

Anonymise in 2 minutes: the swap trick

Copy the message into your notes app first, not straight into AI.

Swap: full name → first name or "the customer"; street address → suburb; phone/email → delete; business client → "the builder".

Paste into AI. When the reply comes back, put the real details back in yourself.

Use this prompt only on text you've already cleaned. AI can miss things, so read the result before you use it.

Copy this prompt and fill in the [square brackets]:

Before we start: the text below should have no personal details. If you spot any names, phone numbers, emails, street addresses, rego numbers or account numbers, replace them with [NAME], [PHONE], [EMAIL], [ADDRESS], [REGO], [ACCOUNT] and show me the cleaned version only. Don't do anything else yet.

Text: [paste]

Tip: Keep a "swap list" in your notes, e.g. Customer A = Mrs Smith, Kauri St, so you can match replies back later.

ChatGPT settings (OpenAI)

Last checked: 16 Oct 2026. Menus move — look for a setting with this name.

Personal plans (Free, Plus, Pro) may use your chats to train models unless you opt out.

Turn it off: profile icon → Settings → Data controls → "Improve the model for everyone" → off. New chats then won't be used for training. They still show in your history. It applies across your devices.

Temporary Chat: not in your history, doesn't create memories, not used to train models. OpenAI may keep a copy for up to 30 days for safety. If you save it, it becomes a normal chat.

Business plans (ChatGPT Business / Enterprise): OpenAI says it doesn't use workspace content to train its models by default.

Tip: Sources: help.openai.com data controls and temporary chat articles (checked 16 Oct 2026). More on ChatGPT for tradies.

Claude settings (Anthropic)

Last checked: 16 Oct 2026. Menus move — look for a setting with this name.

You choose whether your chats help train Claude: Settings → Privacy → "Help improve Claude" → off. Anthropic says that with it off, chats aren't used for future training. With it on, de-identified data may be kept up to 5 years.

Deleted chats leave your history straight away and Anthropic's systems within 30 days.

Incognito chat: not saved to history, no memory, not used to train Claude. Kept around 30 days.

Thumbs up/down feedback can send that conversation to Anthropic, even with training off. So don't rate chats that contain customer info.

Business plans (Claude Team / Enterprise, "Claude for Work"): commercial terms usually say content isn't used for training by default — verify on Anthropic's commercial privacy page.

Tip: More on Claude for tradies.

Gemini settings (Google)

Last checked: 16 Oct 2026. Menus move — look for a setting with this name.

With Keep Activity on, Google may use chats to improve its AI, and a sample is read by human reviewers (kept up to 3 years, disconnected from your account). Google says: if it's on, don't enter anything confidential.

Turn it off: Gemini Apps Activity → Keep Activity → off. Future chats aren't used for training (unless you send feedback). They're still kept for up to 72 hours.

Temporary chat: not used to train Google's AI.

Google Workspace (business) account: Google says chats and uploads aren't reviewed by humans or used to train models outside your organisation without permission. Your Workspace admin controls history.

Tip: More on Gemini for tradies.

For every AI app

Do these on every app you use for work:

Not sure which AI app suits your business? Take the 2-minute quiz.

• Turn on two-step login (protects your chat history if your password leaks)
• Don't share chat links that hold customer info. Delete old shared links
• Clear chats with customer details once the job's logged
• Business plans usually add stronger data terms. Check the current plan pages on ChatGPT, Claude and Gemini — we don't list prices here

Customers and consent: what to tell people

NZ (IPP3) and AU (APP 1/5, if covered): tell people what you collect and why. Simple fix: add one line to your quote/booking form and your website privacy page.

Ask first if you want to use a customer's photos or story in AI-written marketing (before/after posts, case studies).

AI phone answering or call recording: tell callers. Rules differ between NZ and the AU states (verify). See missed calls.

If someone asks what you hold about them (NZ IPP6), you need to be able to find it. Another reason not to leave customer details scattered across AI chats.

Tip: Ready-to-copy line (edit it to suit): We use secure software, including AI tools, to help write quotes and replies. We don't put your bank details or other sensitive information into AI tools, and a real person checks everything we send you.

One-page AI rules for your team (template)

Fill in the brackets, print it, and get staff to sign. Copy the whole template below.

NZ businesses must report serious privacy breaches to the OPC (NotifyUs). AU businesses covered by the Act have the Notifiable Data Breaches scheme. Check the current wording and links on privacy.org.nz and oaic.gov.au (verify).

Copy this prompt and fill in the [square brackets]:

[BUSINESS NAME]: How we use AI tools
Last updated: [DATE]   Person in charge: [NAME]

1. Approved tools: [e.g. ChatGPT Business / Claude / Gemini in our Google Workspace]. Don't use other AI apps for work without asking [NAME].
2. Use work accounts only, with two-step login on. Never share logins.
3. Settings: model training OFF (or a business plan), chat history cleared monthly.
4. GREEN, OK to paste: job descriptions with first name + suburb, our own price list and wording, general questions.
5. AMBER, clean it first: customer messages, photos, supplier pricing, staff names. Remove surnames, phone numbers, emails, street numbers, faces and plates.
6. RED, never paste: bank/card details, IRD/TFN, licence or passport numbers, passwords and alarm/gate codes, health info, customer lists or exports.
7. A person checks everything before it goes to a customer or is used on a job. AI never signs off prices, safety, electrical, gas, plumbing, structural or legal matters.
8. We tell customers we use AI tools to help with admin (see our privacy page).
9. Something go wrong? (wrong person emailed, private info pasted, account hacked) Tell [NAME] the same day. We'll check whether it's a notifiable privacy breach.
10. We review these rules every [6/12] months.

Signed: ____________  Date: ________

Is ChatGPT safe for my business?

Safe enough for most admin if you keep private details out, turn off training (or use a business plan) and check the output. It's not the place for bank details, passwords or health info.

Does ChatGPT keep what I type?

Normal chats stay in your history until you delete them. Temporary chats can be kept for up to 30 days for safety. With training off, your new chats aren't used to train the AI (OpenAI, checked 16 Oct 2026).

Does the Privacy Act apply to my small business?

NZ: yes, every business. AU: most businesses with $3 million turnover or less are exempt, but not all. Check the OAIC's questionnaire. Not legal advice.

Can I paste a customer's message into AI?

Yes, after you strip out surname, phone, email and street number. Put the details back in yourself.

Do I need to tell customers I use AI?

Telling people how you handle their info is part of the privacy rules (NZ IPP3). A one-line note on your privacy page or quote form is a simple way to do it.

Is a paid plan safer than the free one?

Business plans (ChatGPT Business, Claude Team, Google Workspace) say they don't use your content for training by default and give you admin controls. Personal paid plans like ChatGPT Plus still need the training setting turned off.

What if I've already pasted something I shouldn't have?

Delete the chat, change any password or code you shared, and, if it was sensitive customer info, assess whether it's a notifiable breach (NZ: OPC; AU: OAIC). Not legal advice.