Here's a habit millions of people picked up almost overnight: pasting things into a chatbot.
A tricky work email. A spreadsheet of customer numbers. A medical symptom. A draft contract. A screenshot of a bank statement. A long, honest paragraph about a relationship problem.
It feels private. It's just you and a text box.
It isn't. And most people have no idea where that information goes next.
What Happens When You Hit Enter
When you type into an AI tool, your input is sent to the company's servers to be processed. That part is unavoidable. The model has to read your words to respond.
What happens after that depends on the company, the product and your settings. Broadly, your data might be:
Stored. Conversations are often saved, sometimes for a long time, so you can see your history and so the company can investigate abuse.
Reviewed by humans. Some services allow staff or contractors to read samples of conversations for safety and quality purposes.
Used for training. Depending on the provider and plan, your conversations may be used to improve future models, unless you opt out.
Shared with partners or vendors. Cloud providers, analytics tools and integrated apps can all touch your data along the way.
Kept after you hit delete. Deleting a conversation from your screen doesn't always mean it's immediately erased from every system.
Translation: the text box is a front door, not a vault.
Consumer vs. Business Plans Are Different
This is the detail most people miss.
Many AI companies treat free and consumer accounts differently from paid business accounts. Business and enterprise plans often include stronger promises: no training on your data by default, shorter retention and contractual protections. Consumer plans may have looser defaults, with privacy controls buried in settings.
If you run a business and your team uses personal AI accounts for work, your company's data may be governed by the weakest terms available. I cover the broader business risks in How Much Does AI Really Cost a Small Business?
The Bigger Data Machine
Chatbots are only the most visible part. AI depends on enormous amounts of data, and much of it was collected without anyone asking.
Large AI models have been trained on vast scrapes of the public internet: articles, forum posts, photos, books and code. That has sparked lawsuits from authors, artists and publishers who argue their work was used without permission or payment. I tried to cut through the noise on one of the big cases in The Simplest Explanation of the OpenAI Lawsuit.
And AI is supercharging surveillance in the physical world too. License plate readers like Flock cameras track where cars go, building detailed movement histories, a trend I compared to Orwell in In 1984, Orwell Imagined Total Monitoring. Today, Flock Cameras.
The Real Risk Isn't Always a Hack
When people think about data privacy, they picture sophisticated hackers. In reality, many of the biggest exposures come from ordinary carelessness.
Remember the hotel check-in system that left a million passports exposed? No password, no protection, publicly accessible. Then it was called a "misconfiguration."
The more data AI companies collect and store, the more there is to misconfigure, leak or misuse. Every conversation you save is one more record that has to be protected forever.
How to Protect Yourself
You don't have to stop using AI. You just need to use it like someone is reading over your shoulder, because sometimes someone is.
Check your settings. Most major AI tools let you turn off chat history or opt out of having your conversations used for training. Find those settings and use them.
Don't paste what you wouldn't email to a stranger. Social Security numbers, passwords, account numbers, medical records, client data and confidential business documents don't belong in consumer AI tools.
Anonymize first. If you need help with a document, strip out names, numbers and identifying details before pasting it.
Use business plans for business data. If your company uses AI, provide approved tools with proper data protections and a simple written policy for what can and can't be shared.
Read the privacy policy summary. You don't need the full legal text. Look for three things: Is my data used for training? How long is it kept? Can I delete it?
Be careful with AI browser extensions and apps. Some third-party tools that "add AI" to your browser or email can access far more than you realize.
What Should Change
Let's be clear: the burden shouldn't fall entirely on users to dig through settings.
Privacy-protective defaults should be standard, not premium features. Training on personal conversations should require clear opt-in, not buried opt-out. Companies should disclose plainly what they keep, for how long and who sees it.
AI companies say they want our trust. Trust starts with telling us what happens to our words after we hit enter.