Data Privacy — What You Must Never Paste Into a Prompt

A hosted model is software running on somebody else’s computers. When you type into the browser and press Enter, your text is packaged up, sent over the internet, processed on those computers, and an answer is sent back. Nothing about that flow is unusual — it is how most of the web works. The relevant difference is what the receiving end keeps, and for how long.

Almost every consumer AI product stores your conversations. It has to, at minimum, so you can scroll back through yesterday’s chat. That is storage, and storage means the text exists somewhere outside your machine for some period of time. How long, and whether you can delete it, varies by product and by the plan you are on.

Separately from storage, there is the question of training — whether the provider uses what you submit to improve its models. Some products do this by default on the free tier and offer a setting to switch it off. Others say they never train on business or API traffic. The same brand can behave differently across its consumer app and its developer API. None of that is guessable from the interface.

A third possibility worth knowing about: several providers describe a process where a limited sample of conversations can be looked at by people, usually for safety or abuse review. Again, the specifics differ. The honest instruction is not “assume the worst” and not “assume it is private” — it is “open the data policy for the exact product and plan you are using, and read what it commits to”.

Some categories are not a judgement call. They should never be typed into a hosted prompt box, on any plan, for any reason, no matter how convenient it would be. Five of them cover almost every real incident.

First, anything that authenticates you. Broker login IDs and passwords, trading PINs, the seed string behind a two-factor authenticator app, One-Time Passwords, the answers to your security questions. A model cannot log in on your behalf from a chat window, so there is no legitimate reason to type these anywhere except the broker’s own login screen.

Second, API keys and secrets. This one catches careful people, because it usually arrives inside something else. You paste a Python script so the model can find a bug, and your broker API key is sitting on line four in plain text. The key is as good as a password: it can place orders and read your account. Strip it before you paste, every single time.

Third, identity documents and identifiers — PAN, Aadhaar, bank account numbers, demat and client codes, address proofs, or photographs of any of these. Fourth, the personal data of anyone whose money or account you handle. Fifth, unpublished research you intend to publish or trade on, which gets its own section below because the reasoning is less obvious.

The first four red lines are intuitive. The fifth usually needs explaining, because the objection people expect — “the model will steal my idea and give it to someone else” — is not really the point. A language model does not lift your paragraph out of a conversation and hand it to a stranger the next morning. That is not how these systems behave.

The real reasons are duller and more practical. Your draft has left your control. It may sit in a stored conversation you cannot fully account for. If your product’s settings allow training on submitted text, your unpublished view has been contributed to a process you cannot inspect. None of that is theft. All of it is a loss of custody over material whose entire value depends on when and to whom it is released.

For a research analyst that timing is the job. A note has a publication moment and a defined audience. Material circulated outside your control before that moment sits awkwardly against the discipline of publishing it properly. The same logic applies to a retail trader with a plan they have not executed yet — a position you are about to build is information about your own future actions.

There is also a quieter failure. Drafts change. A view you sketched at 11pm and abandoned by morning is not a view you would want preserved anywhere as a record of your thinking. Keeping unpublished work inside your own files means the only version that ever leaves your desk is the one you decided to stand behind.

Your live holdings are not credentials. Nobody can trade your account because they know you own a mid-cap chemicals name. This is a genuine grey zone rather than a red line, and reasonable people land in different places on it.

Here is the case for caution. A full holdings list with rupee values is a precise financial profile of you: roughly what you are worth, how much risk you take, how concentrated you are, and what you are likely to do next. On its own it is fairly harmless. Attached to your name, your email and a stored conversation history, it becomes a considerably more interesting document than any single line item in it.

Here is the case that it usually does not matter — and it is a good one. You almost never need the real numbers to get the answer you were looking for. If you want to know whether your book is too concentrated, weights answer that better than rupees do. “Position A is 34% of the book, B is 22%, and A and B are both in the same sector” gets you a sharper reply than the same information in absolute amounts, because the model is not distracted by arithmetic it handles poorly anyway.

So the practical rule is not “never discuss your portfolio”. It is “discuss its shape, not its balance”. Percentages instead of rupees, sectors and roles instead of scrip names where the name is not load-bearing, and no account identifiers anywhere near it. You lose nothing analytically and you stop building a profile of yourself on someone else’s server.

Redaction sounds like an extra chore. In practice it is a fifteen-second habit that removes most of the risk from most of the work you would ever want to do. The trick is to replace identifiers with stable placeholders rather than deleting them, so the text still reads as a coherent document.

Swap a client’s name for “Client A” throughout. Swap an account number for “[ACCOUNT]”. Swap a PAN for “[PAN]”. Keep the placeholder consistent within one document so relationships survive — if the same person appears four times, they should be “Client A” four times. The model reasons about structure perfectly well without knowing who anybody is.

The second habit is stronger than redaction and easier to forget: work from the public document instead of your private notes. If you want a company’s segment disclosure summarised, paste the relevant pages of the annual report or the exchange filing — that text is already public, so nothing sensitive has moved anywhere. Your private commentary on it can stay in your own file, where it was always more useful anyway.

This reframes the whole problem. Most of what you want from a model is compression and structuring of source material. Source material for listed companies is overwhelmingly public: filings on the exchange website, the annual report PDF, the concall transcript, the press release. The sensitive layer is your own view, your own positions and your own clients — and that layer is exactly the part the model does not need in order to be useful.

Most serious AI products now expose some control over this. The names differ, but the two things worth hunting for in the settings are a training opt-out — a switch saying your content will not be used to improve the models — and a retention setting that governs how long conversations are kept before deletion.

Business and developer tiers usually come with firmer commitments than the free consumer app of the same product, because the customers on those tiers demanded them in writing. If you use AI for anything beyond casual questions, it is worth reading which tier you are actually on. People frequently assume their paid subscription carries terms that in fact only apply to the API.

The strongest option is a local model — one that runs on your own laptop or desktop. The text never leaves the machine, so the entire question of retention and training disappears. The trade-off is real: local models are generally less capable than the largest hosted ones, they need a reasonably powerful computer, and you take on responsibility for your own device security. For genuinely confidential material, that trade is often worth making.

The table below is a way to decide, not a ranking. Every row is the right answer for something. The mistake is using the free consumer tier for work that belonged in the last two rows.

Everything above is a matter of your own judgement while the only data at risk is yours. That changes completely the moment somebody else’s information is involved. Then it is not a preference. It is a compliance question, and it has a wrong answer.

India enacted the Digital Personal Data Protection Act in 2023, which governs how personal data about individuals is handled. Separately, a SEBI-registered intermediary carries its own obligations around the confidentiality of client information under the framework it is registered within. Both of those are live considerations the moment client names, PANs, contact details or portfolio records move into a third-party service.

Pasting client information into an AI product is a decision about where that data is processed and who else can hold it. Decisions of that kind are exactly what data protection rules are written about. Whether a particular arrangement is acceptable depends on your registration, your client agreements, the vendor’s terms and the specific data involved — which is a combination nobody can resolve from a general article.

So treat this as a flag, not an answer. Nothing here is legal advice, and this article deliberately states no section numbers, timelines or penalties, because getting those slightly wrong would be worse than not writing them. Have your actual setup reviewed by someone qualified before you route any client data through any third-party tool. Until that review has happened, the safe default is the simple one: do not paste it.

None of this works as a set of principles you agree with in the abstract. It works as a habit attached to a specific moment — the pause between finishing a prompt and pressing Enter. Ten seconds, every time, until it stops being a decision.

The review below is deliberately short. A checklist you actually run beats a policy document you read once and filed. Read the pasted block from the top, not the bottom, because the things that leak most often sit near the beginning of a file: the import lines of a script, the header of a statement, the account row of an exported table.

Run it hardest on anything you did not type yourself. Text you wrote by hand contains what you meant to write. Text you copied — a code file, a broker export, a PDF page, a screenshot — contains whatever else happened to be sitting next to it, and that is where the surprises live.