Is ChatGPT safe for my customers’ information?

This is one of the best questions an owner can ask, and one of the least asked. If it’s on your mind, you’re already ahead.

The short answer: the business versions of these tools, set up properly, are reasonable for everyday customer work. The free versions, used casually, are not the place for customer details. Most of the risk comes from a few habits, and those are easy to fix.

This is practical guidance, not legal advice. Tool settings change often, so check the current settings of whatever you use. I update this page when they change.

What happens to what you type

When you type into an AI tool, your words go to the company’s computers, get processed, and usually get stored for a while. Three things decide how much that matters:

1. Whether your conversations are used to improve the tool. On the free and personal plans of most tools, your conversations can be used to train future versions unless you switch that off. On the business plans (ChatGPT’s business and enterprise plans, Microsoft Copilot signed in with a work account, Gemini inside Google Workspace), the providers say your content isn’t used for training by default.

2. How long it’s kept, and who can see it. Chats are usually saved in your history until you delete them. On a shared login, anyone with the password can read every conversation. That second part catches more businesses than anything else.

3. Where it’s stored. Most of these tools store data outside Canada, usually in the US. That isn’t banned for private businesses, but it’s something you’re responsible for and should be upfront about.

What BC privacy law expects of you

Most private businesses in BC fall under the Personal Information Protection Act (PIPA). Some, especially those that move customer information across provincial or national borders as part of their business, also deal with the federal law, PIPEDA. You don’t need to memorize either one. The expectations boil down to a few things you’d probably agree with anyway:

• Only use customer information for the reason you collected it. Using a customer’s details to reply to their question is fine. Pasting your whole customer list into a tool “to see what it finds” is a different purpose.
• Protect it reasonably. That means sensible settings, no shared passwords, and not putting sensitive details anywhere they don’t need to go.
• Someone is responsible. In a small business, that’s usually you. It helps to write down how you handle this, even if it’s one page.
• Be honest with customers if their information may be handled by a service outside Canada.

The Office of the Information and Privacy Commissioner for BC has plain-language guides for small businesses, and they’re worth ten minutes.

Five rules that cover most of the risk

1. Use a business plan for business work. If customer information is going in, use a work account on a business plan, not your personal free login. It’s the single biggest improvement you can make.

2. Never paste in the high-risk stuff. Social insurance numbers, credit card or bank details, passwords, health information, and anything about kids. There’s almost never a reason to, and it’s where real harm happens.

3. Take the names out when you can. “The customer on the Main Street job wants to move their appointment” works just as well as their full name and address. For most drafting work, the tool doesn’t need to know who the person is.

4. One login per person. No shared passwords. When someone leaves, you turn off their access and their history goes with it.

5. Check the settings once, then write them down. Turn off training on any personal accounts, decide how long chat history is kept, and note it on one page your team can see.

Questions to ask about any AI tool

Before you put customer information into anything new, you should be able to answer these:

Question	What you want to hear
Is my data used to train the tool?	No, or you can switch it off.
Where is it stored?	A clear answer, even if it’s “the US”.
Who at my business can see it?	Only the people who need to.
Can I delete it?	Yes, and you know how.
What happens if I cancel?	You can export or delete your data first.

If a tool or a vendor can’t answer these plainly, that’s your answer.

A one-page policy for your team

Your staff will use these tools whether or not you have a policy, so it’s better to have one. It can be this short:

We use [tool] on our work accounts for drafting emails, quotes and summaries.
Never put in: SINs, card or bank numbers, passwords, health information.
Use "the customer" instead of names when you can.
Ask [name] before trying a new AI tool with customer information.
Everything it writes gets checked by a person before it goes out.

That last line matters as much as the rest. A person should read anything that goes to a customer.

Where people get caught out

It’s rarely the tool itself. It’s usually one of these:

• a shared login that a former employee still knows;
• a staff member pasting a full spreadsheet of customers into a free account;
• a free “AI” browser extension or app that reads everything on screen;
• nobody knowing which tools are actually being used.

The bottom line

You don’t have to choose between using these tools and protecting your customers. Use a business account, keep the high-risk details out, give everyone their own login, and have a person check what goes out. That covers the large majority of the risk for a small business, and it takes an afternoon to set up.

If you’re about to put real customer information through AI and want someone to walk through it with you, that’s a good use of the free hour. I’ll show you what goes in, what never does, and who can see it.

If you are licensed in real estate in BC, AI tools for BC real estate agents covers what is useful on a listing, and what should stay out of the tool.

If the worry is a cloned voice or a fake video asking the business for money, How to spot fake AI videos and voice scams aimed at your small business is the call-back rule and the code word.