What data should you send to an AI model (and what should not)
The most common leak is not a hack: it is an export pasted into a chat window. Three questions before the prompt, what never goes in, and when the model should run on your own machine.
The most common way to leak customer data in 2026 is not a hack. It is someone on the team pasting an export into a chat window to get the week’s enquiries summarised. It is fast, it works, and nobody records it anywhere.
This article is the criterion for deciding what to send and what not to. It is not a list of banned tools: AI is useful, and we use it every day. It is the question worth asking before hitting enter.
The question nobody asks before pasting
When you paste information into a model, that information leaves your systems and enters a third party’s. If there is data about people in there — names, emails, phone numbers, purchase history, a conversation thread — that is a disclosure of personal data, with everything that implies: a lawful basis supporting it, a privacy policy that mentions it, and a vendor that appears in your register.
And there is one more layer, the one almost always forgotten: if the provider stores or processes data outside Chile, that is an international transfer, and under Law 21.719 it has to be disclosed in the privacy policy. It is the same check the law asks for on your cloud, your CRM and your email tool. AI is not a separate category: it is one more vendor.
Three questions before the prompt
- Does the task need this information? Not “it came with the file” — need it. Summarising complaints does not need to know who complained.
- Does it need identities, or only content? For the vast majority of marketing tasks the answer is content. And stripping identity is usually a find-and-replace.
- Could you explain this to the client who owns the data? If the answer is uncomfortable, that is the signal. It is not a legal test, but it is right more often than any checklist.
All three push the same way: minimise the information sent to the model. It is one of the rules in our own Security Policy, and it is not there as a formality: data you never send is the only data that cannot end up somewhere.
What never goes in
One category has no nuance. These never go into an AI tool:
- Passwords, API keys, tokens, private keys, session cookies.
- Database credentials or configuration files containing secrets.
- Sensitive data — health, biometric, affiliation — except with explicit authorisation and justified need.
The first is not a privacy question but basic security: a secret pasted into a prompt is a secret that has to be rotated. And if the paste was accidental, rotating is still the right answer — not waiting to see whether anything happens.
How to send less and get the same answer
The reasonable objection is “less context means worse answers”. Sometimes. For the most common marketing tasks, almost never:
| Task | What usually gets pasted | What is actually enough |
|---|---|---|
| Summarise customer enquiries | The full CRM export | The text of the enquiries, without name, email or phone |
| Classify leads by intent | Name, contact details and full history | The message and the campaign it came from |
| Draft a reply | The whole thread with the person’s details | The last message and the product context |
| Analyse campaign results | The conversions table with identifiers | Aggregated metrics per campaign |
| Debug an error | The log with production data | The log with the values replaced |
The pattern is always the same: the model needs the text, not the identity. If each answer then has to be matched back to a person, that happens inside your system, using an identifier of your own that means nothing outside the CRM.
When the data should not leave the building
Some work cannot be minimised, because reading the full record is the task. There the question changes: instead of what to send the provider, it is whether there should be a provider at all.
A model running on your own machine settles that at the root: no transfer, no third party, no terms to review. It is what we do for part of our internal work, and we document it publicly: setting up the local model is in the local AI guide, and using it as a working subagent in the local subagent guide (both in Spanish).
It is not magic either. A local model is slower, usually less capable than the best commercial model of the moment, and it exempts you from nothing else: the output can still be wrong, it still needs human review, and the processing still needs its lawful basis. The one thing it settles — and it settles it completely — is that the data does not move.
Agents that talk to your customers
An agent in production changes the problem. It is no longer a person deciding what to paste: it is a system reading and writing on its own, many times a day. What applies there:
- Clear action limits. What it may read, what it may write and what it must not touch. High-impact actions are not enabled without controls.
- Human fallback where needed. An agent that cannot escalate is an agent that improvises.
- Reasonable transparency about its automated nature, especially where it can affect commercial decisions or service expectations.
- Versioned or documented prompts. If nobody knows which instructions produced an answer, nobody can audit why it answered that.
- Client approval of commercial criteria, responses, limits and escalation. The agent represents their business, not ours.
And one obvious thing worth saying anyway: AI is support, not a replacement for human judgement on decisions that matter. Its outputs can carry errors, inaccuracies or bias, and they have to be reviewed before being used in contexts that count.
FAQ
- Is pasting a customer list into a chatbot a problem? It is a disclosure of personal data to a third party. Whether it is lawful depends on your legal basis, on what your privacy policy says, and on the contract with that provider. The practical answer is usually simpler: the task rarely needs the identities at all.
- Do AI providers train on my data? It depends on the provider, the plan and the date — and it changes without notice. Do not take our word for it or anyone else’s: check the terms of the specific plan you pay for, and write what you find into your vendor register. A public article is the wrong place to look for that answer.
- Does using AI mean an international transfer? If the provider stores or processes data outside Chile, yes — and under Law 21.719 that has to be disclosed in the privacy policy. It is the same check you should already be doing for your cloud, your CRM and your email tool.
- Does a local model solve everything? No. It solves one specific thing: the data does not leave the machine. It does not make the output correct, does not remove the need for human review, and does not exempt you from having a lawful basis for the processing.