What customer details to keep out of AI tools

Don't paste anything into a chatbot that you wouldn't be happy to see read by a stranger. That's the rule of thumb. The rest of this page is the detail behind it.

What counts as customer details

Anything that points to a real person. In a garden business that's wider than you'd think:

• Names, phone numbers, email addresses
• Home addresses, which are what you're really working with
• Gate codes, alarm codes, key-safe numbers and where keys are hidden
• Times when a house is empty ("owners away until the end of the month")
• Photos of the property with the number or the family visible
• Payment details and bank information
• Anything a customer told you about their health, family or finances

Alarm codes and "away" dates are the ones to guard hardest. They could do real harm in the wrong hands.

What the regulator says

The OAIC, Australia's privacy regulator, advises organisations to keep personal information out of public AI chatbots, and sensitive information above all.¹ It adds that availability alone is no reason to use an AI product.¹

It also says personal information covers inferred, incorrect or AI-generated details about a person.¹ So a wrong detail a tool makes up about a real customer can still count.

That guidance is Australian. Your own country's rules may differ, so read your regulator's pages (listed near the end). This site can't say whether what you do meets any law.

How free and paid tools differ

Settings vary by tool and plan, and they change. Here's one maker's page, as checked on 4 November 2026.²

OpenAI's help page says data sharing is on by default for personal ChatGPT Free, Plus and Pro workspaces.² For its Business, Enterprise, Edu and Healthcare workspaces, the page says content isn't used for training by default.²

It also says that turning off the model-improvement setting doesn't delete or hide saved chats.² So chat history stays on the account unless you delete it.

Other makers have their own pages and their own wording. Look up the one for the tool you use, check the date on it, and read it again every so often.

A simple habit

Describe the job without naming anyone. "The customer in the northern suburb has a side gate on the left." Not the real name, not the street.

Your real details live in your quoting or job software. Join the two at the end, by hand.

Tell everyone who touches the admin, casuals and part-timers included, that this is the rule. Say it in plain words.

Marketing and consent

Separate question: contact details used for promotions. The ACMA's advice in Australia is to log who gave express consent, plus when and how.³ Keep that record in your own system. Don't hand a customer list to a chat tool to sort through.

Where to read the rules

Start at the official site for the country you work in:

• Australia: the Office of the Australian Information Commissioner, at oaic.gov.au
• UK: the Information Commissioner's Office, at ico.org.uk
• US: the Federal Trade Commission, at ftc.gov, and your state's own rules
• Elsewhere: your national or state privacy authority

Whether a rule reaches a small business depends on the country, and sometimes on turnover. The regulator's site, or a qualified adviser, can tell you.

When you know where the limits are, return to the overview of AI in a garden office and choose a task that fits inside them.