Inside a company this subject usually lands in one of two positions. Either “upload everything, it is easier” or “nothing goes in there, it is company data”. Both are decisions taken without anyone looking at which documents are actually being discussed.
Public
Anyone can already see these
Internal
Unpublished, but not actually risky
Sensitive
Written rules, not reflexes
The question that matters at level three
Not “is it safe?” but “what does the contract say?”. The large providers draw an explicit line between consumer accounts and business accounts, and data handling differs between them — including whether it is used for training. That is one page to read rather than an assumption to make, and you read it beforehand, not afterwards — it is the first thing we check in a consulting engagement.
A short policy people can actually follow
- Name the three levels and give two examples of each. Nobody reads more than that.
- State which account is used for work — and explicitly forbid the personal account at level three.
- Require personal data to be replaced with initials or roles when it is not needed.
- Put one name next to the question “am I allowed to upload this?”.
A two-page policy everyone reads beats a twenty-page one nobody opens.
Terms used here
- Training on data
- Using what you send to improve the model. The regime differs between consumer and business accounts.
- Anonymisation
- Replacing data that identifies a person with initials or roles, while keeping the document's meaning.
Where to start
- 1Take ten documents you would work with this week and sort them into the three levels.
- 2Read the terms of the account you use, specifically the training section.
- 3Work only with levels one and two until the rule for level three is written down.
