Customer Data in ChatGPT: What a Small Business Can Paste

Somebody on your team pasted a customer email into ChatGPT this week. Maybe it was a front-desk hire summarizing a complaint, or you, at 10 p.m., asking for a politer way to say no. It saved twenty minutes, and nobody told you.

That is how customer data in ChatGPT becomes a real question for a small business: not through a policy meeting, but through ordinary Tuesday habits. Without a written rule, every employee makes up their own. This article gives you one you can post on the wall today.

Why this is a small-business problem, not just a big-company one

The famous example is Samsung. According to a Bitdefender write-up, engineers there pasted confidential code into ChatGPT to debug it in 2023, and the company responded with a company-wide ban on AI tools. Nobody meant harm. They wanted the problem solved faster.

A shop with eight employees has the same instinct and none of the lawyers. The Stanford 2025 AI Index, as cited by CMIT Solutions, counted 233 AI-related privacy incidents in 2024, up 56.4 percent from the year before. You will not find your own incident in that number until it is yours.

The risk is rarely a hacker. It is a well-meaning employee, a free account on a personal email address, and a chat history nobody reviews.

Customer data in ChatGPT: the three-bucket rule

Skip the long policy. Sort everything your team might paste into one of three buckets, and write the buckets on a card by each desk.

Bucket one is green: nothing that identifies a person or reveals how your business actually runs. Marketing copy drafts, a generic email template, a blog outline, a question about how to word a job posting. Anyone can use any tool for this.

Bucket two is yellow: real business context with names removed. A complaint with the customer's name, phone number, and address stripped out. A price list. A rough monthly revenue figure. This goes only into a paid business-tier account that you control, not a personal login, and only after you have checked that account's data settings.

Bucket three is red, and it never goes into a general chat tool: Social Security numbers, card numbers, bank details, passwords, medical or health details tied to a person, signed contracts with names, and anything a customer gave you in confidence. If a task needs red data, it needs software built for that data, with a vendor you have vetted, not a chat window.

A worked example: the dental office front desk

Take a dental office with two front-desk staff. A patient writes in angry about a billing mix-up. The staffer wants help drafting a calm reply.

The red version pastes the whole email, including the patient's full name, date of birth, insurance ID, and the procedure. That is health information tied to a person, and it does not belong in a general chat tool. Offices covered by HIPAA have extra obligations on top of this, so ask your compliance contact before using any AI tool with patient records.

The yellow version replaces the details first: "A patient is upset about a billing error on a recent visit and says the insurance was charged twice. Draft a short, calm reply that apologizes, says we are reviewing the account, and gives a callback within one business day." The staffer gets the same draft in the same time, with nothing identifying leaving the building. Then they add the name back in their own email.

That swap takes about thirty seconds once it becomes a habit. It is the whole trick.

Three checks before any tool gets a yellow-bucket pass

Do not assume a business plan is safe because it costs money. Policies differ between vendors and change over time, so confirm the details on the vendor's own pages rather than trusting a blog post, including ours. Ask three questions.

First, does the vendor use your inputs to train its models on this plan, and can you turn that off? Second, how long are chats kept, and can you delete them? Third, who on your team can see the account, and can you remove someone the day they leave?

If you cannot find a clear answer to any of the three in writing, the tool stays in the green bucket. Bitdefender's own guidance notes that unless you use a special enterprise version, ChatGPT saves chats and may use them to improve its models, which is exactly why the plan matters.

One more habit costs nothing. Make everyone use a company email address for AI accounts, never a personal one, so you can close access when someone quits. If you are still deciding what is worth paying for in the first place, our piece on how much a small business should spend on AI covers where the money goes.

What USBN does about it in practice

When the team behind USBN sets up AI for a client, the first hour is not about tools. It is a walk through the business: where customer information enters, who touches it, and which tasks are actually worth automating. We sort those tasks into the same three buckets, then build the green and yellow ones and route the red ones to proper software or keep them human.

For a contractor with a van, that usually means AI drafting quote follow-ups from job notes with names removed, while the signed estimate and payment details stay in the invoicing system. For a boutique, it means product descriptions and email copy in AI, with customer lists never leaving the store platform. We write the one-page rule, set up business accounts on company emails, and train the team in a single session.

The sequencing matters too. We go over it in how to decide what to automate first, because a safe automation that saves nothing is just a new login to manage. The rule above is how our AI tools work starts.

The one thing to do this week

Before Friday, ask each person on your team one question: "What have you pasted into an AI tool for work?" Do not make it a trial. Tell them you are writing a rule, not hunting for a culprit, and you will get honest answers.

Write down what they say, sort each item into green, yellow, or red, and put the three-bucket card by every desk. If the list shows you are using red data in a tool you have not vetted, that is your first fix. If you want a second set of eyes on it, book a strategy call and we will go through it with you.