GUIDE · CHATGPT, CLAUDE, GEMINI

Is it safe to paste client data into ChatGPT?

Often it is not, at least not as-is. You can still get the help: remove what identifies people and accounts before you paste, keep the mapping yourself, and put the details back in the answer.

What happens to text you paste

Whatever you paste into ChatGPT, Claude, Gemini or Copilot is sent to the provider and stored with the conversation. Depending on your plan and settings it may be reviewed for abuse, kept for a period after you delete it, or used to improve models. Business and API plans usually exclude training by default; consumer plans often require you to opt out.

None of that is necessarily a problem for your own notes. It is a problem when the text belongs to a client: their names, their customers' emails, their bank details, a contract under NDA. You are then sending someone else's personal data to a third party, and you may not be allowed to.

What to remove before you paste

Names are the obvious part. These identify a person or a client just as well:

• Email addresses and phone numbers
• Bank and card numbers (IBANs, card numbers), tax and national ID numbers
• Postal addresses
• Client and company names, product and project code names
• API keys, tokens and passwords that slipped into a log or a config snippet
• Links to internal systems

The AI rarely needs any of these to help. It needs the structure: who wrote to whom, what was agreed, what went wrong.

The manual way

1. Copy the text into a scratch file.
2. Replace each detail with a consistent placeholder: the same person is always [PERSON_1], the same company always [ORG_1]. Consistency matters; if "Jane" becomes "Person A" in one place and "the client" in another, the AI loses track.
3. Keep a list of what each placeholder stands for.
4. Paste the cleaned text into the AI.
5. In the answer, replace the placeholders back.

This works, and it is tedious enough that most people skip it after the second time. It is also easy to miss an email address in a signature or an IBAN in a footer.

The same workflow with Scrub

Scrub automates exactly those steps on your device:

1. Paste the text into Scrub, or copy it and press Ctrl+Alt+S with the desktop app.
2. Review what it found, grouped by category. Keep anything that is fine to share; add client names to your dictionary so they are always replaced.
3. Copy the scrubbed text and paste it into the AI. It sees Hi [PERSON_1], invoice [MONEY_1] is overdue, please pay to [IBAN_1].
4. Copy the AI's answer back into Scrub (or press Ctrl+Alt+R). The real details return.

Placeholders stay the same for the whole conversation, so follow-up questions keep working.

What Scrub detects, and what it does not

Scrub uses rules with validation rather than an AI model, so it is predictable: emails, phone numbers, IBANs (checked with mod-97), card numbers (Luhn), US Social Security numbers, UK National Insurance numbers, Turkish and German tax IDs, passport and ID numbers when labelled, API keys and tokens from common providers, private key blocks, URLs and addresses. Your dictionary covers names, companies and anything specific to your work.

It does not reliably find names that are not in your dictionary. That is why there is a review step, and why adding your clients' names once is worth it.

A checklist before you paste

• Does this text belong to a client or contain someone else's personal data?
• Have names, emails, phone numbers and account numbers been replaced?
• Are client and project names in your dictionary?
• Did you check signatures, footers and quoted replies?
• Is your AI account set not to use conversations for training?