What stays private when a small business uses an AI assistant?
What stays private depends far more on which plan you use and how you set it up than on AI in general. A free personal account used with default settings is a very different thing from a business plan with clear terms, connected only to what it needs, with a person approving what it sends.
Here is what to check, what to ask, and the habits that keep client information where it belongs.
Consumer accounts and business plans are different
The major AI providers publish separate privacy terms for their business products, and that is where the answers live. Before you put any client information into a tool, read the business privacy page for the one you use:
- OpenAI: Enterprise privacy at OpenAI and its help article on managing data, sharing and privacy in ChatGPT Business.
- Anthropic: Is my data used for model training? and its separate updates to consumer terms.
- Google: the Generative AI in Google Workspace Privacy Hub.
- Microsoft: Data, privacy and security for Microsoft 365 Copilot.
Terms change, so check them again when you renew. The FTC has warned that quietly changing your terms of service could be unfair or deceptive, and that AI companies must uphold their privacy and confidentiality commitments. That is useful leverage: what a provider promises in writing is what you can hold it to.
The four questions to ask any provider
| Question | What you want to hear |
|---|---|
| Is our data used to train your models? | No, by default, in writing |
| How long are prompts and outputs kept? | A stated period, and we can delete them |
| Who at your company can see our data? | Only for named reasons such as abuse checks or support |
| Where is it stored and processed? | Stated clearly, with security certifications you can check |
If a provider cannot answer these plainly, choose another one.
What the assistant can reach
An AI assistant connected to your inbox can read your inbox. That is the point, and also the risk. Give each assistant access to what its job needs and nothing more: the enquiries mailbox, not the whole company drive; the calendar, not the accounts. Use the provider's admin settings to limit who in your firm can connect tools, and review those connections from time to time.
Habits that keep information private
- Use business accounts, not personal ones, so the firm controls the settings and can remove access when someone leaves.
- Keep the most sensitive details out. Passwords, account and card numbers and ID numbers have no place in a prompt.
- Keep a person approving what is sent, at least until you trust the assistant with a task. A draft that never leaves the building cannot leak.
- Write it down. A one-page policy that says which tools are approved and what may go into them is enough for most small firms.
- Tell clients, in your privacy notice, how you use AI. Plain words build trust.
Some professions carry extra duties. Lawyers, for example, should read the ABA's Formal Opinion 512 on generative AI; see also AI receptionist for law firms: what it should and shouldn't do.
Where Bay House fits
We build AI assistants for small firms on business-grade services, connected only to what each assistant needs, with written rules on what it may and may not do. Our assistants draft replies, follow-ups and summaries; nothing is sent without your approval. One Assistant starts from $6,000 and an assistant suite from $15,000; see our pricing. For how this works day to day, read How can a small business use AI to answer enquiries without losing the personal touch? This article is general information, not legal advice.
Common questions
Is it safe to put client information into ChatGPT or another AI tool?
It can be, on a business plan with clear terms on training, retention and access, used under sensible rules. A free personal account with default settings is the wrong place for client information.
Does an AI assistant learn from my business's data?
It depends on the provider and the plan. Each major provider explains on its business privacy pages whether your data is used to train its models; check those pages and your contract rather than assuming.
What information should never go into an AI assistant?
Passwords, full account and card numbers, government ID numbers, and anything a client has asked you to keep confidential that the task does not need. If in doubt, leave it out.
