Sgnalcraft

The applied-AI desk for people who run things.

Get the 7am brief Start the AI Foundations course
Day 13 · Make it run without you

Privacy, copyright and what not to paste

Have a personal never-paste list and the habit of anonymising.

12 min readPlus one task, about 10 min

A shield with three crossed-out icons on one side and one item passing through safely on the other. AI-generated illustration
A decision boundary, not a wall: most of what you are tempted to paste should stop before the tool ever sees it.

The one idea

Treat everything you paste as potentially public. That does not mean every chat is public, and it does not mean every provider treats data in exactly the same way. It means you should make the safe decision before you paste rather than relying on a promise you have not read.

Anonymising is the practical habit. Remove a person's name, account number, exact address, phone number and other identifying details while keeping the shape of the problem. ‘A customer's account is overdue by a small amount’ usually gives an assistant enough to draft a reminder. It does not need the customer to be called Mr Sharma or the account to end in 2298.

Copyright is a separate question. An AI assistant can help you transform text, draft from your notes or suggest an image brief. That does not automatically give you permission to paste someone else's protected work into a service, reproduce a living artist's work, or publish an output without checking the rules that apply where you live. Privacy asks who may see information. Copyright asks who has rights in creative material. Keep the questions separate.

Why it matters

This lesson prevents a serious problem rather than a small embarrassment. A full name beside a health detail, a customer record under an NDA, or an unredacted account number is not just ‘context’. It is somebody else's information, and you may not have permission to move it into an AI service.

The risk is not solved by calling the tool private in ordinary conversation. Consumer accounts, business accounts and team accounts can have different controls around retention, training, access and administration. Settings also change. Check the current data controls for the account you are actually using, and do not make a sensitive decision from a marketing slogan. If your organisation has a policy, that policy wins.

Copyright deserves the same plain treatment. The law differs by country and the position around AI-assisted work is still developing. An assistant can tell you which questions to investigate, but it is not your solicitor and its answer is not a licence. Check permissions, licences and attribution requirements before publishing work that includes other people's text, images, music, logos or distinctive creative material.

The useful habit is not panic. It is substitution. Give the assistant the pattern, the constraints and the question. Keep the identity, secret, full source and irreversible decision out of the prompt unless you have a clear reason and a permitted environment.

Anonymising also improves your own thinking. When you remove the distracting name and exact number, you can see the actual task: classify the message, compare two clauses, find missing information, or draft a neutral reply. If the task stops making sense after the identifiers are removed, ask whether the assistant was being used for useful analysis or merely being given access to a record. That is a worthwhile distinction before any tool is involved.

Make the safe version before you ask

  1. Classify the material before copying it. Is it public, internal, personal, confidential, under a contract, or somebody else's protected creative work? If you cannot classify it, pause. Uncertainty is a reason to remove more detail, not a reason to paste first and investigate later.
  2. Separate identity from structure. Ask what the assistant needs to perform the task. For a late-payment reminder it needs tone, amount range, due-date situation and desired action. It usually does not need a real name, account number or address.
  3. Replace identifying values with stable labels. Use ‘Customer A’, ‘Supplier B’ and ‘Project North’ rather than random replacements that make it impossible to follow the thread. Keep dates broad if the exact date is not necessary, and round amounts when precision is not part of the question.
  4. Ask for a draft or analysis, not an invented fact. Tell the assistant to use only the supplied material and to mark what is missing. Then read the output yourself. An anonymised answer can still be wrong, and anonymisation does not remove the need to verify.
  5. For creative material, identify what you own, what you have permission to use, and what you are merely borrowing as a reference. Ask the assistant to help make an original brief rather than asking it to reproduce a protected work or imitate a living creator too closely.
    Use the facts and constraints below to make an original draft.
Do not reproduce distinctive wording or claim rights I have not supplied.
List anything I should check before publishing.

FACTS AND CONSTRAINTS:
[anonymised notes]
  6. Record the decision in your personal rules. The useful output from today is not a legal conclusion. It is a short list you can follow when you are busy, plus a place to check your tool's current data controls before using a sensitive document.
A document with one section covered by solid redaction bars while the rest remains readable. AI-generated illustration
Remove the identifying section and keep the shape of the problem. That is the whole technique.

See it

Here is the same request twice. The raw version is unnecessarily specific: ‘Mr Sharma's account 4471-2298 is overdue by ₹42,000. Write a firm but polite reminder and mention that his address is 18 Park Road.’ The useful task is to write a reminder. None of those identifiers improves the draft.

The safer version is: ‘A customer's account is overdue by a small amount. Write a firm but polite reminder. Do not threaten legal action. Ask the customer to reply if there is a problem.’ The structure remains. The person does not. The assistant can produce a useful first draft because the identity was never the source of the writing skill.

Now take a copyright example. ‘Rewrite this entire article in the exact voice of a living newspaper columnist’ asks for a reproduction and a style imitation. A better request is: ‘Using the facts in my notes, write a clear 400-word explainer for general readers. Use a calm, concise tone. Do not copy wording from the source. List which claims need checking before publication.’ The second request gives you something original to review and tells you where the risk remains.

The same principle applies to images. A generated picture of an imaginary desk can illustrate a guide. A generated picture presented as a real customer, real product condition or real event is misleading even if nobody can identify the exact software that made it. Put a label on generated material when a reader could reasonably mistake it for evidence, and do not use a label as an excuse to publish material you had no right to supply in the first place.

Raw:        "Mr Sharma's account 4471-2298 is overdue by ₹42,000."
Anonymised: "A customer's account is overdue by a small amount."

Audit what you have already shared

Reading about privacy is forgettable. Reading your own pasted customer details is not, and that discomfort is what makes the rule stick.

  1. Open your chat history from the last two weeks. You turned history on in Day 2, which is why this is possible and also why it is worth doing. Do not copy the conversations into a new tool while you audit them; read them where they already are.
  2. List everything personal or identifiable you have pasted: full names, phone numbers, email addresses, account or invoice numbers, addresses, health information, anything a customer told you in confidence, anything under an NDA. Do not judge yourself. Just write the list and note which chat contains it.
  3. Check your settings. Find the data-training setting and confirm it is off where that option exists. Check the second tool from Day 5 as well, because you may have set it up in one and not the other. If you cannot tell what a setting means, record the question rather than guessing.
  4. Write your personal never-paste list, specific to your work. Add the exception only if you have a real permitted environment and know who controls access.
    I will never paste into an AI tool:
1. ______
2. ______
3. ______
Real people's names, unless: ______
Before I paste a document, I will: ______
  5. Practise the swap on one real message from your list. Keep the structure and the question; remove the identity. Then check the answer is still useful. If it is not, ask which non-identifying fact was missing and add only that fact.
    [real message]  →  [anonymised version]
  6. Ask what you need to check before publishing AI-assisted text or images in your country, then write your own rule. Do not treat the answer as legal advice. Finish with a line you will actually follow.
    I want to publish [what you are making]. Tell me what I need to check about copyright for AI-assisted text and images in [your country]. Be specific about where the rules are uncertain.

Before publishing AI-assisted work, I will ______.

What you should notice

Almost everyone finds more in the audit than they expected. That discomfort is the entire pedagogical content of today. Privacy advice you agree with changes nothing; your own pasted account numbers change what you do tomorrow. If you find sensitive material, do not panic. Review the account controls, follow your organisation's incident process if one applies, and remove or restrict what you can. The important thing is to stop repeating the habit.

The second finding is that anonymising costs almost nothing. People resist it because it feels as though the answer will get worse. It almost never does. The pattern of a problem is what generates a good draft, and the identity is rarely the useful part. You can preserve sequence, roles, approximate amounts, constraints and desired tone without handing over the person.

A final distinction matters. Privacy is about handling information responsibly. Copyright is about rights in material and what you may reproduce or publish. Neither question is answered by the fact that a model produced the words. You still own the decision, the checks and the consequences.

The rule you want is easy to remember: reduce before you share, check before you publish. Reduce the data to what the task needs. Check the account controls, the source material and the legal or contractual position before the result leaves your desk. A cautious workflow is not slower in the long run; it avoids the much slower work of explaining why a private detail or copied passage appeared somewhere it should not.

A checklist with three rows ticked and the final row crossed out to show a rule being applied. AI-generated illustration
Three requests pass the check and one is stopped rather than rationalised. That is what a never-paste list does.

If you have five more minutes

Find out whether your tool has a temporary or incognito chat mode, and what it actually changes. Use it for one-off sensitive questions only after reading the explanation, then write down the limit: a temporary chat is not permission to paste anything you like.

Tomorrow

Assemble everything into one page, and stop one habit.