This is the question owners ask us first, right after “which tool should I use” — and it’s usually asked quietly, like they’re a little embarrassed not to already know. You shouldn’t be. Nobody handed out a manual, and the honest answer is more reassuring than most people expect: yes, it’s safe, if you follow one rule you already know from a much older piece of advice.
The one rule
Never paste in anything you wouldn’t put on a postcard.
A postcard travels through other people’s hands before it gets where it’s going. You wouldn’t write your bank account number on one, or a customer’s home address, or a password. You’d happily write “business is good, we hired two people this spring.” That instinct is the whole rule. If you’d be fine with a stranger glancing at it in transit, it’s fine for AI. If you wouldn’t, leave it out or swap in a placeholder.
What that looks like in practice
Fine to paste in:
- A customer review you’re writing a reply to (it’s already public)
- “A customer named Dave left a 2-star review about a late delivery” — first names and situations are fine
- Your own rough draft of an email, policy, or social post
- A voicemail transcript with names swapped to “the customer” if it gets specific
Leave out or swap for a placeholder:
- Card numbers, bank account or routing numbers, passwords
- Social Security numbers, driver’s license numbers, any government ID
- A customer’s home address or full date of birth
- Anything a competitor could use against you if it leaked (exact pricing you haven’t announced, an employee’s medical situation, a legal dispute in progress)
Most of what a busy owner types in a day — a reply, a summary, a rewrite, a question about a rule — was never going to be a privacy problem in the first place. The postcard rule mostly exists for the handful of times you’re tempted to paste in a whole spreadsheet without looking at what’s in it first.
Why this actually matters (in plain terms)
The companies that make these tools generally don’t want your data either — it’s a liability for them too — but “generally don’t want it” isn’t the same as “it’s technically impossible for anyone to ever see it.” Support staff can review conversations for abuse and safety. Some free-tier settings use conversations to improve the product unless you turn that off. None of that is sinister, but none of it is a vault, either. Treat it like email to a vendor, not like a locked drawer.
Two settings worth checking once: in ChatGPT and Claude, there are account settings to control whether your conversations can be used to train the model. Turning that off takes about thirty seconds and it’s the closest thing to a “be extra careful” switch that exists. You don’t need to hunt for it before your next question — just find it once and move on.
What about the free version?
The postcard rule applies whether you’re on a free plan or a paid one. Paying doesn’t change what’s smart to type; it mostly changes usage limits and which model you get. Don’t let “I’m only using the free version” make you looser with what you paste, and don’t let “I’m paying for it” make you looser either.
The honest bottom line
Millions of small business owners use these tools every day for exactly the kind of work in our tool roundup — drafting, summarizing, rewriting — without incident, because the sensitive stuff never gets typed in the first place. This isn’t a reason to avoid AI. It’s the same judgment you already use with a bookkeeper, a virtual assistant, or a new hire on day one: share what they need to do the job, hold back what they don’t.
If you want the ranked, personalized version of where to start, take the AI Readiness Quiz or grab the free AI Leverage Checklist — both factor safety into the recommendation, not just speed.
Quick answers
Is it safe to put my business information into ChatGPT or Claude?
Yes, if you follow one rule: never paste in anything you wouldn’t put on a postcard. Card numbers, passwords, and a customer’s home address stay out; first names and general situations are fine.
What should I never paste into an AI tool?
Card numbers, bank account or routing numbers, passwords, Social Security or government ID numbers, a customer’s home address or date of birth, and anything a competitor could use against you if it leaked.
Is the free version of ChatGPT or Claude riskier than the paid version?
No. The postcard rule applies to both. Paying mostly changes usage limits and which model you get, not what’s smart to type in.