At the beach, two opposite mistakes get made about GDPR: those who say “you can’t use it, there’s privacy” and those who say “who’s going to read my chats anyway.” Both are wrong — but the second one can get hurt.
GDPR.
The chat feels like a diary: you write it freely, it seems to stay between you and you. It isn’t a diary. It’s a room, and the provider is inside it.
First fact, no beating around the bush: something always reads everything. On every call, automated systems run through what you write and what gets answered back. Not “in suspicious cases”: always, for everyone, by declared policy. Human eyes are a different matter — they come through a gate: they’re triggered when those systems flag something, and only a small number of authorised people can look. No employee browses your chats out of boredom.
So the film of the provider deliberately stealing the strategy from your billion-dollar case and speculating on it, as a formal and deliberate act, is unlikely: they’d do it once, and it would be a company-ending fraud.
But this is where the beach expert stops just a moment too soon. “It doesn’t pay for them to do it” isn’t a wall. It’s a promise. Or rather, a chain of promises: the systems, those who administer them, those who have access, the subcontractors, those who keep the archives. It only protects you if every link behaves well, always. And a long chain of diligent people never holds at 100%. You don’t need a villain: one distracted link is enough — and for a strategy worth a billion, you’re relying on the care of people you don’t know.
Then there’s a second way it gets out, and it’s worse — because it isn’t a moment, it’s forever. It’s one thing for someone to read today. It’s another for your data to end up training the next model: at that point it’s no longer outside your perimeter, it’s cooked into the machine, and you’re not getting it back out. Ink poured into water. And the plan you’re on changes everything: in the free version, by default, your data trains. In the business contract, it doesn’t. Almost nobody knows which one they’re on.
This sounds like an invitation to shut everything down. It isn’t. Not everything you write is worth as much, or as appealing, as that case. The draft of the company Christmas message interests nobody and won’t hurt you if it gets out. The skill isn’t paranoia — it’s calibration. Two quick questions: how much does it hurt me if it gets out, how appealing is it to someone else. High on both: hand on the wheel. Low: paste freely.
The real trap is the lazy reflex of applying “nobody’s interested anyway” to everything — client file included — because it was faster. The risk isn’t the spy. It’s the distracted habit of a Tuesday afternoon.
The takeaway: send as little as possible about what matters. It’s good prompting, it’s privacy, it’s the exact same virtue. In experimentation, be bold; in production, ask yourself whether that data is yours and what it costs you if it gets out. Because in the eyes of the law, the data controller is you, not the tool: “I just used a chat” is not a defence.
Even if you wanted to send everything, it wouldn’t fit. There’s a bottom. Next article.