Is it safe to put contracts and customer details into ChatGPT?

The most useful things to put into an AI tool are often the most sensitive: subcontracts, customer addresses, pricing, photos from site. So it's a fair question whether you should. The honest answer is "yes, if you set it up properly", and setting it up properly takes about ten minutes.

What actually happens to what you paste in

When you type or upload something into ChatGPT, Claude, Gemini or Copilot, it's sent to the provider's servers to be processed. Three questions matter:

1. Is it used to train their AI? If so, fragments of what you entered could in theory influence what the model says to other people later.
2. How long is it kept? Your chat history is usually stored until you delete it, and sometimes for a period after that.
3. Who can see it? Providers generally reserve the right for staff to review content in limited cases, such as investigating abuse.

Free and personal plans vs business plans

This is the single biggest difference, and it's where most small businesses get caught out.

• Free and personal plans (like ChatGPT Free or Plus) have generally used your conversations to improve the provider's models unless you turn that off in the settings.
• Business plans (ChatGPT Business or Enterprise, Claude for Work, Gemini in Google Workspace, Microsoft 365 Copilot with a work account) generally don't train on your data by default, and come with business terms about how it's handled.

If staff are using AI for work, it's worth paying for a business plan. It's not much more than a personal one, and it means you control the accounts when someone leaves.

The ten-minute setup

• Use a business plan, or at minimum turn off model training in the data or privacy settings of a personal account. In ChatGPT this is under Settings → Data controls.
• Use work email addresses for accounts, not personal Gmail, so the business owns them.
• Turn on two-factor sign-in. Your chat history is now a record of your contracts and prices.
• Decide what's off limits and tell your team (see the list below).
• Delete old chats with sensitive material once you're done, or set history to auto-delete if the tool supports it.

What to keep out of a chatbot

Even with good settings, some things don't belong in a general-purpose chat tool:

• Passwords, bank details, tax file numbers and licence numbers. There's no reason an AI needs them.
• Other people's personal information you don't need. If you're asking for help with a complaint email, the AI doesn't need the customer's full name, phone and address. Write "the customer".
• Documents with a confidentiality clause, unless you're comfortable it allows it. Many head contracts and subcontracts restrict sharing project information with third parties. An AI provider is a third party. A business plan with proper data terms is a much easier position to defend than a free account.
• Health or medical information about workers or customers, beyond what's strictly necessary.

Does the Privacy Act apply to my business?

Australia's Privacy Act 1988 generally applies to businesses with annual turnover over $3 million, plus some smaller businesses (for example, those that provide a health service or trade in personal information). Many trade subcontractors fall under the threshold, but that's changing over time and your clients may still expect you to look after their information properly.

The Office of the Australian Information Commissioner (OAIC) has published guidance on using commercially available AI products. The gist is sensible: be careful about entering personal information, especially sensitive information, into publicly available AI tools, and be open with people about how you use AI. If the Act applies to you, read the guidance on the OAIC website.

What about photos from site?

Site photos are one of the most useful things to give an AI. It can read a switchboard, identify fittings, or see what's changed. Watch for what else is in the frame: people's faces, number plates, documents on a desk, a home's interior with personal belongings. Crop when you can.

What to ask any AI tool you're thinking of buying

For tools built for trade businesses (job management, quoting, variations), ask:

• Is my data used to train your AI or anyone else's?
• Which AI providers process my data, and on what terms?
• Can other customers (or the builders I work for) see my prices?
• Who owns the data, and can I export it and have it deleted if I leave?
• How do people sign in, and is every action logged?

For what it's worth, those are the questions we answer in the Variation Capture FAQ: your data is yours, it isn't used for training, and each subcontractor's prices are kept separate.

The short version

Use a business plan, turn off training, keep passwords and unnecessary personal details out, and check confidentiality clauses before uploading contracts. Do that and AI tools are no riskier than the email and cloud storage you already use. Next step: ten practical ways to use ChatGPT in a trade business.