Somebody on your team pasted a customer’s complaint, name and account number into a chat tool to get help writing a reply. It worked. It also sent that customer’s details to a company you have no contract with, under terms nobody read. Multiply that by every helpful employee and every AI feature a vendor has quietly switched on in software you already pay for.
You are not against AI. You are against not knowing where the data went.
AI data privacy for business comes down to a handful of concrete questions: does the provider keep what you send, does it train on it, who can see it, where is it stored, and what do you do to reduce what you send in the first place. This article answers each, explains the contract terms, and gives you the list to put in front of every vendor.
What AI data privacy for business actually means
Think of the way you already handle a customer’s file. It stays in your system. When you send it to your accountant or your lawyer, an engagement letter says what they may do with it, and they are professionally bound not to use it for anything else. You would not hand it to a stranger who offered to type it up for free.
Every AI feature is a stranger offering to type it up. When you use a model, the text you send (the prompt) leaves your building and is processed on the provider’s computers. What happens next depends on the terms. Under some, it is processed and discarded within moments. Under others, it is kept for a period for abuse monitoring. Under the worst, it may be used to improve the provider’s models, which means fragments of it could, in principle, surface for someone else.
The good news is that the major providers now offer acceptable business terms, and there are technical steps that reduce what you send so the terms matter less. The bad news is that the defaults, especially in consumer products and in AI features bolted onto software you already use, are often not those terms.
1. Separate consumer tools from business terms
The free or personal version of ChatGPT, Claude, Gemini and the rest is a consumer product. Its terms are written for individuals, and historically several have permitted using conversations to train models unless you opt out. The business, team, enterprise and API (the interface developers use to build with a model) versions have different terms, and the major providers state that data sent under those is not used for training.
So the first rule is boring: nobody in the business uses a personal account for work data. Buy the team or business plan, or build on the API under a business agreement, and say so in writing to staff. This one policy closes the most common leak. Read the specific terms for the product you buy; they differ by plan, and they change. Where this article says “the major providers state”, verify it on their current data-usage page and save a copy of what you read and when.
2. Find and read the training clause
The training clause is the sentence that says whether your data may be used to improve the provider’s models. In a business agreement it should say no, or only with your explicit opt-in. If it says the provider may use “de-identified” or “aggregated” data to improve services, ask what that means in practice; it can be fine and it can be a loophole.
The same clause hides in the software you already use. CRM, helpdesk, accounting and document tools have been adding AI features, each with a data-use term, sometimes buried in an update to the terms of service. Ask each vendor directly: is any of our data used to train models, yours or a third party’s, and which AI providers do you send our data to. A vendor that cannot name its AI subprocessors (the companies it passes your data to) has not done its own homework.
3. Understand retention, and ask for zero where it matters
Retention is how long the provider keeps what you sent. Even where data is not used for training, many providers keep prompts and responses for a period (thirty days is a commonly quoted window) for abuse monitoring, then delete them. Some offer a zero data retention option on request or in an enterprise agreement, under which prompts are processed and not stored beyond the request.
For most businesses, a short retention window under business terms is acceptable. For regulated data (health records, financial account details, anything a law or a client contract says must not leave your control), zero retention is the thing to ask for, and its availability may decide the provider. Ask in writing. Retention also applies to your side: the logs your own system keeps are data too. Decide how long you keep them and who can read them.
4. Send less: mask before the model
The most reliable privacy control is not a contract. It is not sending the data. For most business tasks the model does not need the customer’s name, account number, address or card details. It needs the substance of the complaint, the structure of the document, the fields on the form.
Masking (also called redaction or pseudonymization) replaces identifying values with placeholders before the text goes to the model, and swaps them back afterwards. “John Smith at 14 Elm Street, account 88213” becomes “[CUSTOMER_1] at [ADDRESS_1], account [ACCOUNT_1]”. The model writes the reply to [CUSTOMER_1], and your system puts the name back before anyone sees it. The model never held the identity.
In the systems we build, this step sits in front of every model call that touches customer records, done with plain code and pattern matching first, with a small model used only to catch what patterns miss. It is not perfect (a customer who types their own name into a message can slip through), so it is layered with the contract terms, not a replacement for them.
5. Consider running the model yourself for the sensitive cases
Open-weight models (models whose files you can download and run on your own hardware or in your own cloud account) have become good enough for many business tasks: classification, extraction, drafting, summarizing. Running one on a server you control means the data never leaves your environment. No training clause, no retention question, no subprocessor.
The trade is capability and effort. The strongest models are still the hosted ones, and running your own means someone maintains a server with a capable graphics card and keeps the model updated. The sensible pattern for most businesses is a mix: hosted models under business terms for general work, and a self-hosted model for the one task that touches the data you most need to keep in. The provider trade-offs are in Choosing an LLM Provider for Your Business in 2026.
6. Get the contract right
For anything beyond a team subscription, there are documents to ask for. A data processing agreement (DPA), which sets out what the provider may do with personal data on your behalf, is standard and most providers publish one. A list of subprocessors. A security summary or an independent audit report (SOC 2 is the common one in the United States; ISO 27001 elsewhere). A statement of retention and training terms. A breach notification commitment with a timeframe. A statement of where the data is processed and stored, which matters if you have customers or contracts in places with data-location rules.
If you operate in a regulated sector, add the sector’s own agreement: a business associate agreement for health data in the US, for example. A provider that will not sign it cannot be used for that data. Keep all of this in one folder with the date, so that when a customer or an auditor asks “where does our data go”, you can answer in five minutes.
7. Control what your own AI systems can reach
Privacy is not only about the provider. An AI system that connects to your CRM, your email and your documents can expose data internally: an assistant that lets a sales rep ask “what did the owner email about the acquisition” because nobody scoped what it could read. The AI’s permissions should be no wider than those of the person using it. The general discipline is in AI Agent Permissions: Least Privilege for Business AI.
There is also a newer risk: text inside a document or email can carry instructions that trick the AI into revealing or sending data it should not. That is prompt injection (Prompt Injection Explained: AI Security for Your Business), and for privacy purposes the defense is the same: the AI cannot leak what it cannot reach. Document pipelines are where the most sensitive material flows in bulk; the privacy controls belong at the front of the pipeline in AI Document Processing for Business, From PDFs to Clean Data, not bolted on after.
8. Write the policy and train the people
All of this collapses without a written page that staff have read. It says: which tools are approved for which data, which are banned, what may never be pasted anywhere (card numbers, health details, passwords, anything under a client NDA), what to do if something is sent by mistake, and who to ask. One page, reviewed twice a year, because the tools change. Then say it out loud in a meeting, with examples. The chat-tool leak is nearly always a helpful person who did not know.
Picture a business like this one
The business below is a composite of the kind of company that writes to us, not a client. The numbers describe the shape of the problem, not a case study.
Picture a business like this one: an accounting firm with twenty-five staff, hundreds of client files, and a partner who wants to use AI to draft client letters and summarize documents. Two juniors are already pasting client details into a free chat tool. The engagement letters promise confidentiality and the professional body has rules on it.
What gets built for a firm like this:
- A written AI use policy: business accounts only, approved tools, a banned-data list, and a one-line rule for mistakes.
- A team plan under business terms with a signed DPA, no training, and a retention statement on file.
- A masking layer in front of every model call from the firm’s own tools, replacing client names, tax IDs and account numbers with placeholders.
- A self-hosted open-weight model on a rented server for the one task that handles raw tax documents.
- A folder of contracts and a twice-yearly review date.
What changes is that the juniors get a better tool than the one they were using, sanctioned and faster, so the leak stops without anyone being told off. The partner can answer a client’s “do you use AI on our data” with a page, not a shrug. And the document summarization runs on the firm’s own server, a sentence the firm can put in its engagement letter.
What it costs to run
Business and team plans from the major providers run roughly $20 to $30 per user per month, more for enterprise tiers; check the current pricing pages. Using the API under a business agreement is billed by usage and for most small businesses is tens to low hundreds of dollars a month.
Masking adds nearly nothing: it is code running on your own server. A self-hosted model is the significant line. Renting a cloud server with a capable graphics card is in the region of $200 to $600 a month, less if it only runs during working hours; a modest machine on your own premises is a one-time cost of a few thousand dollars plus someone’s time to maintain it. Audit reports and DPAs cost nothing to ask for.
The mistakes we see most
- Personal accounts for work data. The biggest leak, and the cheapest to close.
- Never reading the update to the terms. The CRM added AI, the terms changed, nobody noticed which third party now sees customer records.
- Trusting the contract alone. Send less. Masking means a bad day at the provider is a smaller bad day for you.
- Zero retention for everything, or for nothing. Regulated records need it; a marketing draft does not.
- An internal assistant that can read everything. Scope it to what the asker may see.
- No written policy. Staff cannot follow a rule they have not seen.
When to bring in help
An owner can do a great deal alone: move the business to team plans, read the training and retention terms, collect the DPAs, write the one-page policy, and hold the meeting. None of that needs a developer, and it covers most of the risk.
A developer is needed for the masking layer, for scoping what an internal AI system may reach, for a self-hosted model, and for the logging that shows what was sent where. These are real engineering, and a vendor who waves them away is telling you something; the questions to ask are in How to Hire an AI Consultant Without Getting Burned.
Levelbrook builds AI systems for businesses with these controls in from the start: masking before the model, scoped access, logs, and everything running in accounts and on servers you own. Fixed price from a written scope. If you are not sure where your customer data is going today, the form below is where to start.