Special session

Confidentiality

your screentyped
in transitencrypted
their serversread by a machine
storeddays, or years
reused?depends on the door
Things that identify someone 0 One sentence. Typed in three seconds.

Why this session

“I just pasted it”The contract, the pricing grid, the client’s email. To save ten minutes. Where did it go?
“It remembered”Two weeks later, in another conversation, the tool brings up a client you never mentioned. It did not guess.
“It was in the news”Source code pasted into a chatbot. Shared conversations in search results. A meeting bot that emailed the wrong people.

Confidentiality is not a setting. It is a question you ask before you paste. Today you learn which one.

Four things

What you leave with

  • One picture: the journey of a prompt, from your screen to wherever it ends up. And the three questions that journey raises.
  • Five ways it leaks, with the real stories behind each one. None of them needed a hacker.
  • Eight reflexes, one of them live: taking the names out of a prompt without losing the answer.
  • Three doors, the same model behind all three. And what to do if it already happened.

No legal text, no vendor names. The mechanism, and the habits that follow from it.

01

Where your words go

A prompt leaves your screen the moment you press Enter. Five stops, and three questions along the way.

your screen and then?
The journey

The journey of a prompt

Your screenYou type it. You still own it. For one more second.
In transitEncrypted, like your online banking. This is not where the risk is.
Their serversRead by a machine, to answer. Sometimes by people: support, safety review.
StoredThirty days. Or as long as your account exists. Deletable, if you ask.
Reused?Used to train the next model? It depends on the door you came in by.

Three of these stops raise a question. Transit does not. Storage and reuse do.

Live

What did you just send?

a persona companya figurea contact or referencea sensitive word
Nothing yet.Type a prompt. Every piece that identifies someone lights up.

You did not send a question. You sent a name, a figure, and a deadline. Together, they are a deal.

The journey

Three questions to ask any tool

  1. 1Is it kept, and for how long?A day, thirty days, forever. And can you delete it yourself, or do you have to ask?
  2. 2Is it used to train?If yes, your words help build the next model. And what a model learned can surface in someone else’s answer.
  3. 3Who can read it?The vendor’s staff, for support or review. Your own company’s admin. A court, with a request.

None of the three is answered by the chatbot. All three are answered by the door you came in by.

02

Five ways it leaks

No hacker in any of them. Five real stories, and the ordinary gesture behind each one.

what you typed five seams
What happened · 2023 · a large electronics maker
  • 1An engineer pastes source code into a public chatbot. To find a bug. It works.
  • 2A colleague pastes a meeting recording. For the minutes. It works too.
  • 3Three incidents in twenty days. All on the consumer door, where prompts could be used to train.
  • →The company banned every generative AI tool on its devices. For everyone.
Leak 1

You paste it

The most common leak is not an attack. It is Ctrl-V.

Nobody was careless. They were efficient. The code was the fastest way to get the answer. It was also the crown jewels.

What the tool remembers about you
  • Works in sales at a software company. Prefers short answers.
  • Writes in French, asks for English drafts.
  • Negotiating a renewal with Carrefour. Budget cap 40k. Contact: Marie Lefèvre.
  • Has a weekly pipeline review on Mondays.
Two weeks later · a different conversation

Help me prepare a first call with a new retail prospect.

Sure. As with Carrefour, where your cap was 40k, you could open with…

Leak 2

It remembers

Some tools now keep notes on you, across conversations. Useful. And a second copy of everything you said.

On a shared login, or a family account, those notes are not yours alone. Whoever types next inherits them.

What happened · 2025 · a popular chatbot
chat.example.com/share/7f3a…copy link

“Share this conversation” made a public page. A small box offered to make it discoverable. Thousands ticked it.

web search · “renewal budget cap”
How to negotiate a renewal — blogexample.com › guides
Draft a reply to Carrefour: we can go down to 40k if…chat.example.com › share · shared conversation
Renewal pricing strategiesexample.org › sales
Leak 3

You share it

A share link is a web page. Anyone with the link can read it. And sometimes, anyone with a search engine.

People shared a clever prompt with a colleague. The page held the whole conversation. Including the client above it.

What happened · 2024 · an investor call
  • 10:00Video call. A founder, three investors. An AI note-taker joins, invited by an investor.
  • 10:45The founder leaves. The investors stay on. So does the note-taker.
  • 10:46They discuss, frankly, what they think of the founder and the deal.
  • 11:30The transcript is emailed to every participant. Including the founder. Every word.
Leak 4

It listens

A meeting assistant does not know the meeting has ended. It knows the call is still open.

It records, transcribes, summarises, and sends. To the list it was given. The after-meeting chat included.

The company drive · connected to the assistant
  • Shared / Sales / Proposals 2026team
  • Shared / Marketing / Brand kiteveryone
  • Shared / Finance / salaries_2026.xlsxeveryone
  • Shared / HR / Onboardingeveryone

What is the average salary in the sales team?

Based on salaries_2026.xlsx, the average is…

Leak 5

It reads what you can read

Connect the assistant to the company drive, and it reads with your permissions. All of them. Including the ones nobody meant to give you.

The folder was open to everyone for years. Nobody looked. The assistant looks at everything, in one second.

In the real tool · memory on

What do you remember about me?

A list. Your job, your habits. And, if you ever mentioned one, a client, a figure, a name.

Then · the share dialog

Share this conversation

A link. Anyone with it reads the whole thread, from the first message. Not the one answer you wanted to show.

Two clicks each. Neither one asked you if you were sure.

Live

Let me
show you.

What it kept about me. And what a share link really shows.

Prepared this morning: a conversation with a made-up client in it. Let us ask the tool what it remembers, then open the share page as a stranger.

03

Eight reflexes

Before you paste, while you type, after you have sent. None of them needs permission from anyone.

Reflexes

Before you paste

  1. 1Take the names outClient A, Person B, a round figure. The model does not need the real name to write the reply. You add it back after.
  2. 2The excerpt, not the fileThe three clauses that matter. Not the signed contract, with the parties, the prices and the signature page.
  3. 3The competitor testIf this landed in a competitor’s inbox by mistake, would you survive it? If not: not in an unapproved tool. Even scrubbed.

Same question, no names. Same answer.

Live

Scrub it

What you paste instead
Nothing yet.Type a prompt on the left. The scrubbed version writes itself on the right.

The answer does not change. The model needs the structure of your problem, not the name of your client.

Reflexes

Which door, which switches

  1. 4Know your doorLook at the account before you paste. A personal login, a free plan: the consumer door. Your company’s login: the business door. Two different contracts, same screen.
  2. 5Switch off what you do not needMemory. “Improve the model for everyone.” Chat history. The note-taker that auto-joins. Each one is a switch, and each one ships on.
Settings · what to look for
Improve the model with my conversationsoff
Remember across conversationsoff, or reviewed
Meeting assistant joins automaticallyoff
Keep chat historyas short as your work allows

Names change with every version. The switches do not.

Reflexes

After you have typed

  1. 6A share link is a publicationTo show one answer, take a screenshot and crop it. Never a link to a conversation with a client in it. Revoke the ones you made.
  2. 7The note-taker leaves with youAnnounce it at the start. Stop it when the meeting ends. Check who receives the transcript before it goes.
  3. 8Ask, then delete“What do you remember about me?” Ten seconds. Delete what should not be there. Once a month.

You cannot see what it kept. So ask it.

Eight reflexes

Take the names outClient A, Person B, a round figure.
The excerpt, not the fileThree clauses, not the signed contract.
The competitor testWould you survive it landing there?
Know your doorLook at the account before you paste.
Switch off what you do not needMemory, training, the auto-joining bot.
A share link is a publicationScreenshot, cropped. Never a link.
The note-taker leaves with youAnnounce, stop, check the list.
Ask, then delete“What do you remember about me?”
04

Three doors

The same model sits behind all three. What changes is the contract, and who holds the keys.

consumer business your own walls
Three doors

Same model, three doors

ConsumerPersonal e-mail, free or paid plan
Signed
Nothing. You clicked “I agree”.
Trained on
Often yes by default. A switch to turn off.
Kept
As long as your account. You delete by hand.
Admin
You. Nobody else can see, or wipe.
BusinessYour company’s login
Signed
A contract. Your company, with the vendor.
Trained on
No. By contract, not by a switch.
Kept
What your admin set. Days, or a policy.
Admin
Your company. It can audit, and wipe.
Your own wallsA model on servers you control
Signed
Nothing to sign. Nothing leaves.
Trained on
Only if you decide to.
Kept
Where you put it. Your rules.
Admin
You, entirely. Including the upkeep.

Same engine, three cars. The question is never “is this model safe”. It is “which door am I in”.

The question everyone asks the tool

Do you keep my conversations? Are they used to train you?

“No, I do not store any of your data, and nothing you write is used for training.”

Fluent. Reassuring. And a prediction, not a fact. The model does not know what its vendor does with your words.

Three doors

Ask the contract,
not the chatbot

The chatbot answers about itself the way it answers about anything: with the most plausible sentence.

Three places know the truth: the settings page, the privacy policy, and the contract your company signed. Only one of them was written for you.

05

If it already happened

You pressed Enter. The name was in it. Three things to do before lunch, in this order.

! it is out make it smaller
The same day

Delete, revoke, tell

1DeleteThe conversation. Then ask the tool what it remembers, and delete that too. Deleted usually means: leaves the training queue, gone from the servers within weeks.
2RevokeThe share link, if you made one. The connector, if it read too much. The note-taker’s access to your calendar.
3TellYour IT or data-protection contact. Today. Not to be blamed: because if personal data is involved, the company has seventy-two hours to notify. Early is the only thing that makes it smaller.

Nobody is punished for telling on day one. People are punished for day thirty.

One sentence ties it all together
Once it is sent,
it is out of your hands.

So decide before you paste:
which door, and which words.
Before next time

Find the paste

Take

One prompt you sent this week with a real client in it. Rewrite it with the names out.

Bring

Both answers, side by side. And the door you were standing in when you sent the first one.

The eight reflexes fit on one page. It is yours to keep.

Questions?

Thank you.

Confidentiality · Special session
← → navigate  ·  O overview  ·  F fullscreen

Rotate your device to present.