Using AI in your business without risking your customers' data

More small business owners are using an AI chat to draft a reply, summarize a contract or answer a customer’s question. The risk isn’t using the tool — it’s pasting in, without thinking twice, a piece of data you shouldn’t hand to a third party.

What you should never paste into an AI chat

Whatever you type into an AI chat leaves your business and lands on another company’s servers. Avoid pasting:

• Customers’ personal data: full name together with phone number, email, address or an official ID number (in Mexico, the CURP or RFC).
• Financial data: card numbers, bank accounts or payment receipts that show those numbers.
• Sensitive data: health information, religion, union membership, sexual orientation or anything the law treats as sensitive because of the harm a leak would cause.
• Passwords and access keys (“API keys”) to your systems or your customers’.
• Full contracts, quotes or conversations, even if you only want the AI to summarize them: the whole document still travels to the provider.

One simple rule saves you from deciding case by case: if you wouldn’t post it on an open social network, don’t paste it into an AI chat.

What to check in your provider’s terms of service

Before using an AI tool to work with customer information, look in its contract or privacy policy for:

• Whether it uses your conversations to train its models by default, and whether you can turn that off. Each provider explains this on its own page; OpenAI, for example, covers it for its business plans.
• How long it keeps your data, and whether you can ask it to delete it.
• Which country stores and processes it: that decides which authority can review it and under which law.
• Whether the free or personal plan follows the same rules as the business plan. They almost never do: business plans usually offer more control over how your data is used, sometimes at an extra cost.
• Whether it subcontracts another provider (a “data processor,” in the law’s language) to run the service.

Keep that review in writing, dated. If you ever have to explain to a customer or an authority what happened to their data, you need to show what you checked and when — not just that you trusted the provider.

How to reflect it in your privacy notice

In Mexico, the Federal Law on the Protection of Personal Data Held by Private Parties (Ley Federal de Protección de Datos Personales en Posesión de los Particulares, or LFPDPPP) requires any business that handles personal data to keep a current privacy notice stating what data it collects, what it’s used for, and who it may be shared with. The law was renewed in 2025, so if your notice hasn’t been reviewed in years, it probably doesn’t cover everything the current version requires.

If you use an AI tool that processes customer data — a support chatbot, a document-reading assistant, a call-transcription service — that tool usually counts as a transfer or as processing handled by a third party on your behalf. Your privacy notice should say so clearly: which tool is used, for what purpose, and, if applicable, that data is transferred to a provider outside your business.

A generic notice downloaded from the internet years ago isn’t enough. This isn’t a minor formality, especially if your business handles sensitive data (health, financial, minors): review your notice with your lawyer or accountant before adding a new tool, not after a complaint.

What to check this week

1. List the AI tools your team already uses today, even informally: the chat someone opened on their phone to answer a customer’s question counts too.
2. Write down what information never gets pasted into those tools, using the examples from the first section, and share it with your team.
3. Check whether your privacy notice mentions using AI tools to handle or process customer data; if it doesn’t and you’re already using them, update it.
4. If any tool handles sensitive data, confirm with the provider whether a business plan offers stronger privacy guarantees than the personal or free plan your team may be using today.

Using AI safely in your business doesn’t mean giving it up — it means knowing what you’re handing over, to whom, and what your privacy notice says about it. If you’re about to add an AI assistant to your WhatsApp support or any other process that touches customer data, our AI automation service can help you set those rules from day one.