How to Remove Personal Data Before Pasting Into an AI Chat

The worry is not that a model reads your text and broods on it. It is that a paste cannot be recalled, and that four separate things travel with it, each governed by a different rulebook.

• →Retention. Conversations are kept by default in consumer products, and several keep a copy for a period after you delete one. The durations differ by product and change without much fanfare, so the policy of the specific product is the only reliable source.
• →Training. Consumer tiers commonly improve models from conversations unless the setting is turned off; business, enterprise and API tiers commonly do not, by default or by contract. The switch is in a different place in every product, and it is worth finding before the first paste rather than after.
• →People. Safety and abuse review means a human being can read a flagged conversation. That is a reasonable safeguard, and it is also a route your customer's data can travel.
• →Your own promises. A privacy notice that names your processors, a data-processing agreement with a client, a clause about sub-processors: pasting into an assistant that appears on none of those lists is a contract problem well before it is a security one.

None of that makes the habit reckless. It makes it a decision of the same weight as forwarding the text to an outside contractor — fine for most things, once you have taken out the parts that were never needed to answer the question.

The obvious move is to replace everything sensitive with a label. It protects the values perfectly and, often, destroys the question. A tag repeated eleven times in a log could stand for eleven customers or for one, and the interesting fact — that the same address appears in every failed request — is precisely the fact the tag erased.

• →Identity across lines: whether the account on line 40 is the account on line 12 is usually the whole investigation.
• →Kind: a sixteen-digit number that passes its checksum is a payment instrument; an order reference is not. One label over both loses the distinction.
• →Neighbourhood: two addresses in the same subnet, two mailboxes at the same domain, two timestamps a second apart — proximity survives only if something is left to compare.
• →Register: a page of tags reads as a document about redaction, and assistants oblige by commenting on the redaction.

Partial masking — last four digits, domain kept — restores some of that and is the right choice for a spreadsheet a colleague has to read. It is still the wrong choice here, for a different reason: the reply will refer to the masked form, and someone then has to work out which mailbox each one was, by hand, for every mention.

The alternative is substitution. Each real value is swapped for an invented one of the same kind, consistently, and the correspondence between them is kept so that whatever comes back can be translated. Two properties do the work: consistency, meaning one value keeps one stand-in everywhere it occurs, however it was capitalised or spaced; and fidelity of kind, meaning an address is replaced by something that is recognisably an address.

Fidelity matters more than it sounds. It also raises a question the careless version of this trick gets wrong: invented values must be unmistakably fictional, or a plausible-looking replacement becomes somebody's real mailbox in whatever the assistant drafts next. The standards bodies set aside ranges for exactly this.

Payment cards are the instructive exception. There is no reserved block, and a number that fails the Luhn checksum does not read as a card at all, so a stand-in has to be a structurally valid number that belongs to no issuer and no account. The same logic applies to anything carrying a check digit: the replacement passes the arithmetic and refers to nothing.

Where that correspondence lives is therefore the whole security question. It belongs wherever the original data already belongs — on the machine doing the work, under the same access rules — and specifically not in the conversation. Asking the assistant to reverse the substitution for you hands over the one thing the substitution was protecting.

Automatic detection works on form. Emails, card numbers, IBANs, coordinates, keys and network addresses have a recognisable one; the most identifying sentences in a support ticket generally do not.

• →People's names, and the names of small companies, which identify a person almost as precisely.
• →Street addresses and postcodes written the ordinary way, and dates of birth written in words.
• →A diagnosis, a disciplinary note, a debt, an immigration status — sensitive precisely because of meaning, which is the thing form cannot see.
• →Internal code names for projects, customers and environments, which identify an employer to anyone who has heard them.

There is also the combination problem. Attributes that are unremarkable alone can single one person out together: research on US census data found that a large share of the population is uniquely identified by postcode, date of birth and sex in combination. A ticket describing the only Dutch-speaking account on the enterprise plan has named its subject without using a name, and no scanner will ever flag that sentence.

Which leaves two habits that do more than any detector. List the words that matter — names, companies, code names — so they get substituted like everything else. And send less: the forty lines around the error rather than the file, the disputed invoice line rather than the ledger. Text you never paste needs no cleaning and cannot leak.

Some material is not a cleaning problem. Health records, cardholder data under PCI DSS, children's data, anything under legal privilege, and anything covered by an agreement that names its permitted processors: for these the choice is an approved deployment with a signed agreement and a no-training commitment, or doing the task another way. A cleaned copy of a medical record is still a medical record.

One habit is worth breaking early, too. A credentials file pasted in to ask what a setting does is a set of credentials to rotate, whatever the retention policy says — and rotating a key costs an afternoon, while explaining why it was not rotated costs considerably more.

For the ordinary cases the calculation is different and much friendlier. A log, a ticket, an export, a config: a minute of substitution is the difference between a question you can ask and one you have to answer yourself. The Sensitive Data Scanner here does the detection, the stand-ins and the reverse step in the page, with the correspondence held in the tab and nowhere else.