AI Privacy at Work: What You Can and Can't Paste

What you paste into an AI tool at work depends on three things: whether the service trains on your data, how long it stores your chats, and what legal protections your company has in place. Enterprise tools like Google Workspace Gemini and Microsoft 365 Copilot promise not to train on customer data and let you control retention. Consumer chatbots often reuse prompts to improve their models.

The real danger is not that your data ends up training the next ChatGPT. It is that your pasted customer list sits in a chat log for months, accessible to anyone who gets into your account. Understanding where your data goes after you hit send is the difference between a helpful assistant and a compliance nightmare.

In the last episode, you built your first no code automation. Now you are ready to feed AI real work data. But before you paste that spreadsheet, you need to know where it goes.

A simple way to think about AI data handling

Think of pasting into an AI like handing a note to a colleague. The colleague reads it, uses their existing knowledge to respond, and then something happens to the note. They might shred it immediately. They might file it in a locked cabinet. Or they might pin it on a public bulletin board.

Different AI tools handle your note in different ways. Some shred the note right after reading it. Others keep a copy in a secure cabinet for a set time. A few treat the note as public material they can use to teach new colleagues. The tool's policy, not its intelligence, determines which path your data takes.

What happens the moment you paste?

The AI does not read your text the way a human does. It converts your words into numbers called tokens. Each word or part of a word becomes a token. These tokens are fed into a mathematical model that predicts the next token, one after another, until it builds a response.

This entire process happens inside a fixed context window. The model can only "see" a limited number of tokens at once. Your pasted text, plus the conversation history, must fit inside that window. Once tokens fall out of the window, the model forgets them for that interaction. The model's internal knowledge, its weights, does not change during this process. It is a read only operation.

So the act of pasting does not train the AI. It only provides temporary context to shape the answer. The model's behavior for that one chat is influenced by your data, but its permanent memory stays the same. source

Where do logs and histories fit in?

While the model forgets your data after generating a response, the service around it may not. Most AI tools keep logs. They record your prompts and the model's answers. These logs serve several purposes: abuse monitoring, reliability analysis, and sometimes product improvement.

The retention period for these logs varies wildly. Google's Gemini in Workspace lets administrators set retention from 90 days to indefinite. The separate Gemini app for enterprise defaults to 18 months, but admins can shorten it to 3 or 36 months. If conversation history is turned off, new chats persist for only 72 hours to keep the service running. source

Consumer products often keep logs longer and may use them to train future models. OpenAI's privacy policy states that personal data from ChatGPT can be used to improve services. By contrast, data sent through the OpenAI API (application programming interface) is not used for training unless the customer opts in, and abuse logs are deleted after 30 days by default. source

This is the critical split. The model itself does not learn from your paste. But the service provider might store your paste and later use it to fine tune a new model. That is where the real privacy risk lives.

How do enterprise tools protect your data?

Enterprise AI products add contractual and technical safeguards that consumer tools lack. They treat your prompts and responses as customer data, subject to the same privacy terms as your email or documents.

Google Workspace Gemini processes your content under the Cloud Data Processing Addendum. It does not use your data to train generative AI models outside your domain without permission. Human reviewers do not read your prompts. source

Microsoft 365 Copilot anchors its answers in your Microsoft Graph data: emails, documents, calendar items. It inherits Microsoft 365's existing security, privacy, and compliance commitments, including GDPR (General Data Protection Regulation) and EU data boundary features. source

Slack AI promises that customer data never leaves Slack. It is not used to train any large language models. The AI only answers questions based on data the requesting user could already see. source

Apple Intelligence runs many models directly on your device. When it needs more power, it uses private cloud compute servers that do not store your data. This architecture keeps your information off remote logs entirely. source

The common thread: these tools promise no training on your data, limited retention, and access controls that mirror your existing permissions. They are not magic. They are just bound by stronger rules.

What data is safe to paste where?

Alex, our operations manager, has a spreadsheet of customer orders. It includes names, email addresses, and order totals. She wants the AI to summarize it. Can she paste it safely?

The answer depends on which tool she uses and what her company has set up. Here is a practical guide.

Public or already published information is safe with almost any AI tool. Press releases, public product descriptions, and industry reports carry little privacy risk.

Internal but non sensitive data, like meeting notes or draft reports, can go into enterprise tools that do not train on your data. Alex's order summary, if it contains no payment details or personal identifiers beyond what is needed for the task, is likely fine in Google Workspace Gemini or Microsoft 365 Copilot, provided her admin has configured retention properly.

Confidential intellectual property or regulated personal data, such as health records or financial account numbers, needs tighter controls. Use only systems covered by a robust data processing agreement. Never paste this data into a consumer chatbot that logs prompts for improvement.

Secrets like passwords, API keys, or private encryption keys should never be pasted into any networked AI service. Even enterprise tools can expose them in logs, error messages, or support tickets. Treat every AI input field like a public channel when it comes to secrets.

Quick reference: major AI tools and their privacy stance

Frequently Asked Questions

Q: Can my company see what I paste into an AI tool? If you use a company provided enterprise tool like Google Workspace Gemini, your organization's admins can typically access logs and conversation histories, just like they can with your email. Always assume your employer can see activity on work accounts.

Q: What if I accidentally paste a password? Change the password immediately. Then report the incident to your IT or security team. They may need to rotate related credentials and check if the tool's logs could expose the secret. Do not assume the AI "forgot" it.

Q: Does using incognito mode help? Incognito mode in a browser only prevents local history storage. The AI service still receives your data and logs it according to its own policies. It does not make your prompts private to the provider.

Q: Are there AI tools that run entirely on my device? Yes. Apple Intelligence runs many models on device. Some open source models can run locally on a laptop. These options keep your data off remote servers entirely, but they may be less capable than cloud models.

Q: How do I know if my company has an enterprise agreement? Check with your IT department or look at the login page. If you sign in with your work email and see your company's branding, you are likely on an enterprise plan. Consumer tools usually ask for a personal account and do not mention your organization.

Test yourself

Alex, the operations manager, needs to draft a performance review for a team member. The review contains feedback about specific projects, sales numbers, and a note about a medical leave the employee took. Alex uses Microsoft 365 Copilot, which her company has configured with standard retention policies. She pastes the draft into Copilot to ask for phrasing suggestions. Is this safe? What should she check first?

Answer: The sales numbers and project feedback are likely fine because Copilot inherits the company's existing data protections and does not train on customer content. The medical leave note is the problem. Health information is sensitive personal data under many privacy laws. Even with enterprise safeguards, pasting it into an AI tool creates a new copy that could be retained in logs or appear in future responses if the data is indexed. Alex should remove any health details before pasting. She should also verify with her IT team that Copilot's retention settings align with company policy and that the tool is not configured to index her prompts for search. When in doubt, treat the AI like a new colleague who might repeat what you say.

If you want clear, no nonsense breakdowns of how workplace AI actually works, subscribe to Internals Decoded at internalsdecoded.com. Next week, we will tackle the one question every manager asks: is this AI actually saving me time?

Sources

• Google Workspace Gemini privacy
• Microsoft 365 Copilot privacy
• Slack AI privacy principles
• Apple privacy
• OpenAI privacy policy
• OpenAI API data usage policies