Before Uploading Client Data to an AI Tool: Privacy and Commercial-Use Checklist

A commercial-use badge answers only one narrow question. It does not tell you whether you can upload customer data, whether prompts are retained, or whether the output is safe to publish.

Classify the data before choosing a tool

Seven checks before upload

• Purpose: Can the task be completed with anonymized or synthetic data?
• Retention: How long are prompts, files, logs, and generated outputs stored?
• Training: Can content be used to improve models, and is there an opt-out?
• Access: Which employees, workspace members, integrations, or support staff can access it?
• Location: Where is data processed or transferred?
• Deletion: Can users and administrators delete files and accounts?
• Agreement: Does business use require a DPA, enterprise plan, or separate contractual terms?

Output rights are a separate review

Commercial use may be permitted while a specific output still infringes someone else's trademark, copyright, publicity rights, or confidential information. Record the prompt, source assets, model or feature, date, edits, and final human approver for important commercial work.

Account controls

Enable multi-factor authentication where available. Use organization-owned accounts, role-based access, shared billing controls, and offboarding procedures instead of sharing one personal login.

Practical rule

If a task would be unsafe to email to an unknown external contractor, do not paste it into a consumer AI tool until your organization has reviewed the provider, plan, settings, and agreement. Product pages are useful starting points, but legal and security decisions should use the current terms and advice appropriate to your organization.