The privacy checks to make before uploading a file to an AI assistant

Training opt-outs, temporary chats and shared links may not protect uploaded files as users expect. Here are the account, retention and document checks to make before sharing data with an AI assistant.

Uploading a file to an AI assistant can be efficient, but it can also expose more than the user intended. A spreadsheet may carry hidden comments, a contract may contain unrelated names, and a setting that appears protective may govern only one part of a service’s data handling. The safest approach is to check the account, the workspace, the connected services and the file’s likely destination before anything is uploaded. As guidance from iTechGuides notes, these controls vary by product, account type, location and administrator policy, so the same menu label does not always mean the same thing.

The first check is the account itself. A personal profile and an employer-managed workspace can operate under different rules even when they use the same AI product. In practice, that means a work email alone is not proof that workplace protections are enabled, and it also means an organisation’s policies may be stricter than the service defaults. The same guide from iTechGuides stresses that users should not assume one permission covers every kind of file or every type of business data.

Training controls are the next point to review, but they are often misunderstood. Turning off model improvement does not necessarily erase chat history, memory, or uploaded files, and it does not prevent every other form of retention. The article notes that these settings must be checked separately because opting out of one data use does not switch off the others. In other words, a privacy choice that affects future training may still leave the conversation visible in the account history.

Temporary or incognito modes can help when the task is narrow, but they are not a universal deletion tool. They may keep a conversation out of the ordinary history and reduce model use, yet providers can still retain data for a period for safety, service or operational reasons. iTechGuides also highlights that temporary modes are not a substitute for understanding the file retention rules that sit behind them. For work accounts, these modes should be treated as convenience features, not as a way around workplace controls.

Memory and personalisation deserve separate attention. An assistant may be configured to remember details from earlier interactions even when routine model training is disabled. That distinction matters because memory can influence future answers long after the original file has been closed. The practical test is simple: if a detail from the document should never reappear in an unrelated exchange, the user should inspect memory settings before uploading and remove any unnecessary saved information afterwards.

Connected apps and cloud services can widen access well beyond the file that was attached. A chatbot linked to email, drive storage, workplace search or other productivity tools may be able to retrieve additional material that was never explicitly pasted into the chat. iTechGuides recommends checking which services are connected and what each one can reach, because disabling a prompt before access is not the same as removing the connection altogether. The narrowest possible scope remains the safest option.

Another risk comes from third-party actions, agents and integrations. A custom tool may hand parts of a request to an outside service in order to complete a task, which means that another company’s privacy and retention rules may then apply. The guide advises users to identify who will receive data from the file and why. If that path is unclear, the better choice is a simpler workflow without the integration, or a redacted version of the document.

Sharing also needs scrutiny. A public or shared link may expose more than the intended answer, including uploaded files or images, depending on the product. The iTechGuides summary warns that a link labelled as a summary does not guarantee that the underlying conversation or attachment is hidden. Anyone who only needs the final output should receive a fresh, cleaned copy rather than a live link to the original session.

Retention and deletion are the final checks, and they are often more complex than users expect. Chat history, saved memories, project files, library copies and public links can all follow different rules, and deleting one item does not always remove the others. The article recommends looking for every place the information may have been stored, then checking whether the service, the workplace or legal requirements impose a further retention period. If the answer is unclear, the upload should be delayed until the storage path is understood.

The most effective privacy step often happens before the upload button is pressed. Users should remove unnecessary names, comments, tracked changes, hidden text and document metadata, then review the cleaned copy before sharing it. If the missing details would make the task inaccurate, the file may need a different approved workflow rather than a general-purpose chatbot. The practical rule is to send only what the task truly requires.