AI Privacy Checklist: 10 Questions to Ask Before Using Any AI Tool

Most people paste a document into a new tool before they read a single line of its privacy policy. That order is backwards, and it is also understandable: the tool is right there, the task is due, and the terms run to several thousand words.

You do not need to read all of them. You need to ask a handful of pointed questions and recognize a good answer when you hear one. Here are ten, plus how to use them.

Start With One Rule

Before any policy reading, apply a blunt test to whatever you are about to type or upload. Would you be comfortable seeing it on a billboard, in a court filing, or forwarded to your manager? If not, it does not belong in a prompt box or an upload field.

If you would wince at seeing it published, do not paste it. No setting makes that risk worth taking.

That rule prevents most accidents. The questions below cover the cases where the material is fine but the handling still matters.

The Ten Questions

Ask them in order. The first few tell you whether the rest are worth your time.

1. What is collected by default? Look past your typed text. Conversations, uploaded files, file names, timestamps, device details, and anything readable through a connected account may land in the same bucket.
2. Is my content used to improve the product, and can I switch that off? Many services train on free-tier traffic but not on paid or business accounts. Find the toggle, then check whether it covers past submissions or only future ones.
3. Do people ever read what I submit? Review, moderation, or quality teams may see samples. Not sinister on its own, but it changes what you paste.
4. Where is it stored, and for how long? "As long as necessary" is not an answer. Look for a stated retention window.
5. Can I delete it myself? A self-serve delete button beats an email request, especially if you might need proof later.
6. What happens if the company is sold or shuts down? Data usually travels with the business. Check whether you would be notified and could export or remove your history first.
7. Does it need the permissions it asks for? A writing helper rarely needs your contacts, microphone, screen recording, or access to every tab you have open.
8. What are the sharing defaults? Public links, shared team folders, and visible chat history are common surprises. Turn them off before you invite anyone else in.
9. What is the smallest-footprint option? Guest mode, a paid tier with training disabled, or a version that runs on your own machine may all exist.
10. Who do I contact if something goes wrong? A real privacy contact and a clear way to report a mistaken upload tell you how seriously the rest is taken.

How to Read the Answers

You are looking for specificity. Vague reassurance is the warning sign; awkward precision is usually a good one.

Signals worth trusting

• A plain-language policy that names what is collected and why, in a page rather than a novel.
• A visible toggle for training or product improvement, with a note on whether it applies retroactively.
• A stated retention period and a delete button you can use without contacting anyone.
• Recognized security certifications and audits you are allowed to request.
• A business or API tier with contractual limits on how your content is handled.

Signals to slow down for

• "We may share information with trusted partners," with no categories listed.
• Retention described only as "as long as needed."
• Deletion available only through a support email.
• Free accounts trained on by default while paid accounts are exempt, with the difference buried in a comparison table.
• Permissions or connected-app scopes far wider than the feature you actually use.

A Ten-Minute Test Before You Commit

Run this on any tool you are about to adopt for real work. It takes less time than reading the policy.

1. Sign up with an alias or an address you can abandon, and give only the minimum profile information required.
2. Open every settings page and screenshot the privacy, data, and connected-app screens so you can compare later.
3. Submit a harmless but unique sentence, such as "The purple bicycle waits outside the Lisbon station on Tuesdays."
4. Use the export or download feature. What appears there is roughly what the service holds about you.
5. Delete the conversation, then check whether it is gone from history and from any shared folders.
6. Ask support one direct question in writing — whether your content is used for training, and how to opt out. Keep the reply. A written answer beats a help page.

If steps four or five fail, treat the tool as public. That is not a reason to avoid it; it is a reason to keep anything sensitive out of it.

When the Answers Are Vague

Sometimes you cannot get a straight answer and you still need to finish the work. Reduce exposure instead of arguing with the terms. Strip names, account numbers, addresses, and anything identifying before you paste. Swap real documents for a short sample with the same structure. Use the tool for the shape of the task — an outline, a rewrite, a summary — and handle the sensitive part elsewhere.

If the material involves health, legal, or financial details, or belongs to a client or employer, your obligations usually come from somewhere other than the tool: internal policy, client contracts, or sector rules. Check with whoever handles compliance before you upload anything, and seek professional advice when the stakes are personal rather than professional.

Make It a Habit

Keep a short list of the tools you actually use, with one line each: what it holds, whether training is off, and how to delete. Review it when you change jobs, when a service announces new terms, and once a quarter whether or not anything seems to have changed.

The goal is not a spotless digital life. It is knowing, for the handful of services you rely on, what leaves your hands and what stays. That is cheap to establish once and expensive to reconstruct after you need it.

Photo: Tumisu / Pixabay