AI Safety Basics for a Small Business

Enlarge image

Close

A safer prompt leaves out the customer's name, street, card, and Social Security number, and says the customer asked to move a Saturday order at $48. Diagram: Sac Business Launch.

1. What not to paste

Keep these out of the prompt, the upload, and the screenshot:

• Passwords and login codes

• Customer names tied to a private problem, plus their phone, email, or address

• Full bank account or card numbers

• Social Security numbers and other tax IDs

• Health details about a customer or an employee

Google's Gemini Apps Privacy Notice says not to enter confidential information you would not want a reviewer to see. It also says chats that a person reviews can be kept for up to three years, even if you delete your activity.

If the task needs a name, write "the customer" and add the name after the draft is on your own computer.

2. Set the privacy controls

Enlarge image

Close

ChatGPT personal accounts: Settings, then Data controls, then turn off Improve the model for everyone. Temporary chats may be kept up to 30 days. Diagram: Sac Business Launch.

Checked on October 20, 2026.

ChatGPT, personal account. OpenAI's help says: Settings, then Data controls, then turn off "Improve the model for everyone." Older chats stay in history. New chats are not used for training. The setting syncs across devices. Temporary chats are not used for training and may be kept up to 30 days for safety reviews.

Free, Plus, and Pro personal workspaces have training on by default. You can turn it off. OpenAI says Business, Enterprise, Edu, and API content is not used for training by default.

Gemini, personal account. Read the Gemini Apps Privacy Notice and set the activity controls it describes. Do not assume a deleted chat is gone the same day.

Google Workspace. Google's Workspace help says Gemini content is not human reviewed and is not used to train models outside your domain without permission. Use the work account for work. A personal free account is a different setting.

Plan names for the tools themselves are in getting started with ChatGPT or Gemini.

3. Check the facts

A draft can sound sure and still be wrong. Before you send, post, or file:

1. Compare every price, date, address, and law to a source you trust.

2. Delete any review, award, or "customers love" line the tool invented.

3. Have a person press send. The tool does not send mail for you unless you set that up on purpose.

4. A few rules that sit outside the settings

• Bots. California Business and Professions Code section 17941 makes it unlawful to use a bot to mislead someone about its artificial identity in order to drive a sale. Say when a customer is talking to a bot.

• Reviews. The FTC rule at 16 CFR Part 465 bars reviews that misrepresent that the reviewer exists or used the product or service. Do not ask a tool to write fake reviews.

• Customer data. The California Attorney General says the CCPA applies to for-profit businesses that meet a size or data test, including over $25 million in yearly gross revenue, or the personal information of 100,000 or more California residents or households, or 50 percent or more of revenue from selling or sharing personal information. Many small businesses fall outside that test. Careful habits still protect the people who trusted you with their information.

Write the team's rule in one page: which tools are allowed, what never goes in, and who reviews the draft. Re-read it when a setting changes.

Common mistakes

• A shared free login with training left on.

• A screenshot of a tax form "just to explain the question."

• Believing a deleted chat is immediately gone.