Privacy and Your Data

Everything you type or upload into an AI tool leaves your computer. Before you paste anything, ask: would I be comfortable if this was stored or seen by someone else?

Where Your Data Goes

When you send a message to an AI service, it goes to the provider's servers. Depending on the product and your settings, it may be:

• Stored for some time, for example for your chat history or for abuse checks
• Used to improve models, on some consumer plans unless you turn this off
• Seen by people during safety reviews in some cases
• Kept by other apps if you use a third-party tool built on top of a model

Business and API plans usually have stricter rules, such as not training on your data. But the rules differ by provider and change over time, so read the privacy settings and terms of the tools you use, and check them again now and then.

Never Paste These

Remove Personal Details First

A small Python script can hide common personal details before text goes to an AI. This is called redaction:

import re

PATTERNS = {
    "CNIC":  r"\b\d{5}-\d{7}-\d\b",
    "PHONE": r"(?:\+92|0)3\d{2}-?\d{7}\b",
    "EMAIL": r"\b[\w.+-]+@[\w-]+\.[\w.]+\b",
}

def redact(text):
    for label, pattern in PATTERNS.items():
        text = re.sub(pattern, f"[{label}]", text)
    return text

message = ("Customer Sana Iqbal, CNIC 42101-1234567-8, phone 0312-3456789, "
           "email sana.iqbal@example.com wants a refund for order 5521.")
print(redact(message))

Customer Sana Iqbal, CNIC [CNIC], phone [PHONE], email [EMAIL] wants a refund for order 5521.

The CNIC pattern matches the 5-7-1 digit format, and the phone pattern matches Pakistani mobile numbers starting with 03 or +92 3. Regular expressions only catch the formats you write, so names and addresses still pass through. Treat redaction as one layer of protection, not a guarantee.

Send Only What Is Needed

The best protection is data minimisation: never send what the AI does not need. To write a polite reply to a complaint, the model needs the complaint, not the customer's CNIC:

customer = {
    "name": "Sana Iqbal",
    "cnic": "42101-1234567-8",
    "phone": "0312-3456789",
    "city": "Karachi",
    "order_id": 5521,
    "complaint": "The shoes are one size too small.",
}

# Send only what the AI needs to write a polite reply
NEEDED = ["city", "order_id", "complaint"]
safe_input = {k: customer[k] for k in NEEDED}
print(safe_input)

{'city': 'Karachi', 'order_id': 5521, 'complaint': 'The shoes are one size too small.'}

Your code can add the customer's name back into the final reply after the AI writes it.

Privacy Rules for AI Apps You Build

• Tell users that an AI answers them, and what happens to their messages
• Ask before storing chats, and keep them only as long as needed
• Do not log secrets: remove keys, passwords and card numbers from logs
• Limit access: only people who need chat logs should see them
• Pick providers carefully: check where data is stored and whether it is used for training
• Follow the law: many countries have data protection laws, and Pakistan has been working on its own. Clients abroad may require rules like the EU's GDPR

Privacy in Daily Use

• Turn off "use my chats to improve the model" if you do not want that, where the setting exists
• Delete old chats that contain sensitive information
• Be careful with browser extensions and "free AI" apps that ask for broad permissions
• Do not upload other people's photos or voice recordings without their permission

Exercise