AI and privacy in everyday life: Which data does not belong in the chatbot?

In short: Inputs to chatbots can be stored, analysed and used for training; therefore passwords, sensitive personal data, customer and company secrets do not belong in them.

In more detail: A chatbot is not a diary. Inputs are processed by providers, often stored (history, security checks, quality improvement) and, depending on settings, used for training. Even if providers name protective measures: what you do not want to reveal, do not type in.

In Depth

Do not enter

• Passwords, API keys, credentials, private keys.
• ID numbers, bank data, health data, confidential family and relationship data, data of other people without their consent.
• Customer data, personnel information, trade secrets, unpublished source code, internal documents, contracts (breaches of confidentiality and GDPR possible).
• Exam and test tasks under secrecy.
• Photos with faces and metadata of others.

How to protect yourself

• Settings: switch off training with your data (opt-out), disable history or use temporary chats, delete account/chats.
• Anonymise/pseudonymise: replace names, places, numbers with placeholders (“customer A”).
• Business versions (team/enterprise, contract with data processing agreement (DPA), EU data processing) instead of private accounts for work data.
• Local models (Ollama) for sensitive content.
• Check browser extensions/apps and integrations (which data do they see?).
• Observe company policy: many companies prohibit or regulate AI use.

Legal framework

GDPR: entering personal data into a service is processing/transfer; it needs a legal basis and often a contract. Data subject rights (access, erasure) also apply towards AI providers. The EU AI Act requires, among other things, transparency (making AI interaction and AI-generated content recognisable) and regulates high-risk applications; details and deadlines are evolving. Professional secrecy (doctors, lawyers) and non-disclosure agreements continue to apply. This is not legal advice.

More notes

• Answers are not privately protected: shared chats can become publicly findable.
• Prompt injection: external content (web pages, documents) can contain instructions that manipulate the AI; give AI agents only necessary rights.
• Deepfakes/voice clones: do not publish voice and images carelessly.
• Children and teenagers: education on privacy, age limits of services (often 13 or 16 years) and parents’ consent. Rule of thumb: Would I write this on a postcard? If not, it does not belong in a cloud chatbot.

See also: Using AI assistants sensibly and safely, Prompt injection, AI Act, Local AI with Ollama and LM Studio, Data processing agreement (DPA)