You just pasted something into an AI chat box. Where did it go?
It felt private. Just you, a blinking cursor, and a very polite assistant.
But that chat box isn't a diary. It's a service running on someone else's computers.
Whatever you paste goes somewhere. What happens next depends on which tool you're using, which account you're signed into, and how it's set up.
None of this is a reason to panic. It's a reason to pause for five seconds before you hit Enter.
The short version:
- A work account and a personal account on the same brand can have completely different rules.
- Work accounts are usually protected from model training. But they're visible to your employer.
- Personal accounts may train on your data unless you opt out.
- Green light for public info. Yellow for internal-but-not-sensitive, and only in an approved tool. Red for anything you wouldn't want on the record.
- When in doubt, swap real names and numbers for placeholders.
Last week's post covered cleaning up who can see what in SharePoint before you turn on Copilot: Before You Turn On Copilot, Clean Up Who Can See What in SharePoint.
The newsletter gave you a 15-minute version: Who can see your payroll folder? Find out in 15 minutes.
This week, we flip it around. Not what AI can see, but what you hand it.
I've worked in IT since 1998 and with SharePoint since 2008. I've heard "it's totally private" about every new tool since dial-up. The question never changes: where does this information go, and who can see it?
Let's follow one paste and find out.
What actually happens when you hit Enter
The details vary by product, but the general path looks like this:
- Your prompt leaves your device. It travels to the provider's service, along with any file you attached.
- The service processes it and sends back a response.
- The conversation may be saved, in your chat history, in your organization's records, or both.
- Depending on the plan and settings, it may be used to improve the provider's models, or reviewed for safety and abuse.
Step 4 is where the fine print earns its keep.
And it depends a lot on which account you're in.
Work accounts and personal accounts are not the same thing
The same brand name can come with very different rules. Same logo, different deal.
Microsoft Copilot with your work account
When you sign in with your work or school account, Microsoft says Copilot and Copilot Chat come with enterprise data protection.
Prompts and responses are covered by the same contractual terms that apply to your organization's email in Exchange and files in SharePoint. Microsoft also says the prompts, responses, and data accessed through Microsoft Graph "aren't used to train foundation models" (Microsoft Learn: Enterprise data protection in Microsoft Copilot and Microsoft Copilot Chat).
Two practical details:
- Look for the green shield. Microsoft says Copilot Chat shows a green shield at the top of the screen when enterprise data protection applies (Microsoft Learn: Microsoft Copilot Chat Privacy and Protections).
- Your organization can see it too. The same page notes that prompts and responses are logged for auditing and eDiscovery.
"Private from Microsoft's training" is not the same as "private from your employer." Those are two very different sentences.
Write prompts you'd be comfortable having on the record.
And remember last week: Copilot only surfaces organizational data people already have permission to see (Microsoft Learn: Data, Privacy, and Security for Microsoft Copilot). Protection on the AI side doesn't fix oversharing on the SharePoint side.
So that's the work side. Now, the account on your phone.
ChatGPT on a personal plan
OpenAI says that for its services for individuals (Free, Plus, and Pro), it may use your content to train its models.
You can opt out by turning off Improve the model for everyone under Settings > Data controls.
One catch worth knowing: if you give a thumbs up or thumbs down on a response, OpenAI says the entire conversation tied to that feedback may be used for training, even if you've opted out (OpenAI Help Center: How your data is used to improve model performance).
That little thumbs up is doing more than you think.
Temporary chat is another option. OpenAI says temporary chats stay out of your history and aren't used to improve its models while they remain temporary, but a copy may be kept for up to 30 days for safety purposes (OpenAI Help Center: Temporary chat in ChatGPT).
Helpful, yes. Invisible, no.
ChatGPT on a business plan
OpenAI says that by default it doesn't train its models on data from ChatGPT Business, ChatGPT Enterprise, or its API.
It also notes that workspace admins on ChatGPT Business can view, export, and delete conversations in the workspace (OpenAI: Enterprise privacy).
Same pattern: protected from model training, visible to your organization.
The takeaway
A personal account is set up for you. A work account is set up for your organization.
Your personal ChatGPT login isn't covered by your company's agreements, no matter how work-related the task feels.
Plans and policies change, so check the current pages above, not a screenshot from last year.
Knowing the rules is half of it. The other half is knowing what to paste.
The traffic-light test: what's safe to paste
Here's a simple way to sort it.
Green: usually fine in most tools
- Public information, like your company's published website copy
- Your own general writing, with no names or numbers
- Made-up examples, sample data, and generic questions ("How do I write a polite follow-up email?")
Yellow: only in a tool your organization has approved for work
- Internal documents that aren't sensitive, like meeting notes or project plans
- Drafts that mention coworkers, clients, or vendors by name
- Anything you'd hesitate to forward outside the company
Red: don't paste it unless your organization has explicitly approved that tool for that kind of data
- Passwords, API keys, and account numbers
- Payroll, salary, HR, or performance review details
- Client, patient, or student records
- Financial statements that aren't public
- Contracts, legal matters, or anything under a confidentiality agreement
When in doubt, treat yellow as red.
Here's what that looks like on an ordinary workday.
Three everyday moments (all made up)
The pretty spreadsheet. Dana, an office manager, wants a messy client list turned into a tidy table. It's late, so she opens her personal ChatGPT on her phone and pastes in 200 client names and phone numbers.
Nothing dramatic happens. That's the problem. Data leaks rarely come with sirens.
The better move: use the approved work tool, or replace the real names with "Client A, Client B" before asking for the formatting help.
The tricky email. Marcus needs to tell a vendor their invoice is late, without sounding grumpy. He asks Copilot Chat, signed into his work account, with the green shield showing, and leaves out the dollar amount.
Green light. That's exactly the kind of help AI is good at.
The performance review. Priya wants help softening the wording in a review she's writing. Instead of pasting the full review with her report's name, she describes the situation in general terms and asks for three gentler ways to say "needs improvement."
She gets useful phrasing and keeps the person out of the prompt.
But what if you're already Dana?
If you already pasted something sensitive
It happens. Most of the time it's survivable. What matters is what you do next.
- Don't panic, and don't hide it. The worst outcome is a small mistake that becomes a big one because nobody knew about it for three weeks.
- Delete the conversation if you can. It reduces what's visible in your history. It may not remove everything the provider keeps for safety or legal reasons.
- If it was a personal account, check your data controls. Turning off model training affects future use. Ask the provider how to request deletion of past data if you need it.
- Tell your IT or security team. Sooner is better than later. They deal with this. It's their job, not a mark against you.
- If credentials were involved, rotate them. Passwords, API keys, and tokens should be changed immediately, before anything else.
- Write down what happened. What you pasted, where, and when. It makes any follow-up much easier.
The goal isn't to punish anyone. It's to make the next five seconds of someone else's day safer.
Better yet, skip the cleanup entirely. Start with a few questions.
Questions to ask your IT or security team
If you don't know what's approved, ask. These five questions get you most of the way there:
- Which AI tools are approved for work use?
- For each one, what kinds of data are allowed?
- Are work accounts protected from model training, and how can I tell which account I'm in?
- Who sees my prompts and responses, and for how long?
- Who do I contact if I paste something I shouldn't have?
If your organization doesn't have answers yet, that's useful information too.
Someone needs to write the policy, and it's better to find out now than after an incident.
Meanwhile, here's what you can do today.
Your 5-minute AI data checklist
- Check which account you're signed into. Work tool, work account. Personal tool, personal stuff.
- Look for the green shield in Copilot Chat before you paste anything work-related.
- If you use personal ChatGPT, open Settings > Data controls and decide whether "Improve the model for everyone" should be on.
- Find your organization's AI guidance. If there isn't any, ask your IT person or manager which tools are approved for work.
- Strip it before you ship it. Swap real names, numbers, and account details for placeholders.
- Use the breakroom fridge test. Would you be fine seeing this taped to the fridge? If not, think twice.
- Check the answer. AI drafts. You decide. Read it before you send it, sign it, or rely on it.
A few honest notes
- It depends on the plan and settings. Your licenses, your admin's configuration, and the provider's current terms all affect what applies to you. What I've described here reflects the providers' published pages as of October 2026.
- "Not used for training" isn't "deleted." Conversations may still be stored, logged, or kept for a period of time for safety, legal, or compliance reasons. Read the sentence that's actually written, not the one you hoped for.
- This is general information, not legal advice. Your organization's policies and your own legal or compliance team come first.
The bottom line
AI tools can save you real time at work. You don't need to fear them.
You just need to stop assuming the chat box is a vault, and know which door you're walking through.
Work account for work. Placeholders for anything personal. And five seconds of thought before you paste.