Using AI safely: what data you should never paste into a chatbot
The list of things you should never share with ChatGPT, Gemini or any AI, why, and which settings protect you. Based on what OpenAI, Google, the Spanish data-protection authority and the GDPR say.
Why what you type into a chatbot matters
Whatever you paste into an AI assistant leaves your device and is processed by the company that provides it. Depending on its settings, it may be stored, used to train models and, in some cases, read by a person. Google says so plainly in the Gemini privacy notice: some data is reviewed by human reviewers, and it asks you not to “include confidential information that you wouldn’t want a reviewer to see”. Those reviewed conversations are kept for up to three years, even if you delete your activity.
The list: what you should never paste
- Passwords, PINs and verification codes (including SMS codes).
- Bank details: card number, CVV, full IBAN, screenshots of your online banking.
- Identity documents: ID card, passport, social security number, photos of these documents.
- Health data, yours or anyone else’s: medical reports, diagnoses, prescriptions.
- Third-party data: clients, patients, pupils, colleagues, relatives. It isn’t yours to share.
- Confidential work information: contracts, payslips, internal data, code or documents your employer hasn’t authorised.
- Other specially protected categories: political opinions, religion, sexual orientation, ethnic origin, trade-union membership, biometric or genetic data (Article 9 GDPR).
- Precise locations and routines: your address, the times your home is empty, your children’s school.
Which settings protect you (and how far)
| Tool | Setting | What it achieves | What it does NOT achieve |
|---|---|---|---|
| ChatGPT | Turn off “Improve the model for everyone” | Your new chats don’t train models | Doesn’t delete chats or stop them being processed |
| ChatGPT | Temporary chat | Out of history, no memory, no training | OpenAI may keep a copy for up to 30 days for safety |
| Gemini | Turn off “Keep activity” | Future conversations don’t train models (unless you send feedback) | They are kept for 72 hours and may be reviewed for safety |
| Gemini | Temporary conversation | Not used for training or personalisation | Same 72-hour retention |
An important detail in both: if you give feedback with the thumbs or the feedback button, that conversation may be reviewed and used to improve the models.
How to ask for help without exposing data
- Anonymise before pasting: change names to “[Client]”, remove addresses and numbers.
- Describe instead of copying: “I have a rental contract with a two-month penalty clause” instead of pasting the whole contract.
- Use temporary mode for personal topics.
- At work, only use what’s authorised. Business versions (for example ChatGPT Business or Enterprise) don’t train on your data by default, according to OpenAI, but that is decided and contracted by your organisation.
If you’ve already shared something
- Delete the conversation from your history.
- Change any passwords you pasted and turn on two-step verification.
- If bank details were involved, tell your bank.
- Get free help: in Spain, INCIBE’s 017 helpline handles cybersecurity questions free of charge and in confidence.
- Your rights: you can ask the company for access to or erasure of your data and, if it doesn’t respond, complain to your data protection authority (in Spain, the AEPD).
This guide is for general information only. For specific data-protection questions at your company, consult your data protection officer or a professional.
Frequently asked questions
If I turn off training, can I paste whatever I want?
No. Turning it off stops your new conversations from being used for training, but they are still processed and kept for a while. In Gemini, even with “Keep activity” off, Google keeps conversations for 72 hours and may review them for safety.
Can I use AI with my clients’ or pupils’ data?
As a rule, don’t paste it into tools meant for personal use. If your company or school has a business version with a data-processing agreement, follow its internal rules and ask your data protection officer.
Who can I turn to if I think I’ve shared something I shouldn’t have?
Delete the conversation, change any passwords you pasted and, if there is a risk of fraud, contact your bank. In Spain you can call 017, INCIBE’s free and confidential cybersecurity helpline; in other countries, contact your national cybersecurity or consumer helpline.
Keep reading
- AI from scratch for non-technical people
- How to use ChatGPT: the complete guide
- AI scams and deepfakes: how to recognise them Coming soon
Sources
- Centro de Privacidad de las Aplicaciones de Gemini (actualizado el 13 oct 2026) — Google
- Data controls in ChatGPT — OpenAI Help Center
- Temporary chat in ChatGPT — OpenAI Help Center
- Reglamento General de Protección de Datos (UE) 2016/679, art. 9 — EUR-Lex, Unión Europea
- Ley Orgánica 3/2018 de Protección de Datos y garantía de los derechos digitales — BOE
- Agencia Española de Protección de Datos — AEPD
- Línea de Ayuda en Ciberseguridad 017 — INCIBE
Change log
- : First published.
Educational content, prepared with the help of AI tools, with sources cited. It is not a substitute for professional advice. Tools change fast: if you spot something out of date, write to us at contacto@cognenza.com. How we work.