Farhana leads programmes at a labour rights network in Dhaka and runs online trainings for its partner groups. Lately, the question she hears most at the end of a session is whether it’s safe to use AI. One partner pastes garment workers’ complaints into a free chatbot to tidy up the English. Another has a note-taker that joins every call by itself, including the one where a worker described a threat from a supervisor. Nobody has asked where any of it goes.
Her answer is yes, with care. This essay explains what happens to what your team types, uploads or records, and which risks are new. It ends with habits to share and a one-page policy that cover most of them.
What we mean by AI tools
An AI tool, in this essay, is a program trained on huge amounts of data so it can predict and produce text, images or sound (Data Detox Kit). Your team probably meets them in four places: chatbots such as ChatGPT, Gemini and Claude (TechSoup); assistants built into email, documents and browsers; AI inside chat apps; and note-takers that join meetings. Some can now act for you as well, which brings risks of its own.
What happens to what you type, upload or record
Most AI tools work by sending your words, files or recordings to the company’s computers, where the AI works out its answer. Working out the answer is what people mean by “inference”. Some tools send more than you’d expect. When you ask an AI browser to summarise something, “the complete content of your active browser tab is packaged and sent across the internet to a third-party AI service”, as the digital rights organisation Autonomía Digital explains (Autonomía Digital). Your questions say something too: what you ask shows what you’re planning and why (Autonomía Digital).
What happens next depends on the tool, the account and your settings. This is how it stood when we checked in October 2026:
- It’s kept. Google’s Gemini app keeps your activity for 18 months unless you change the setting (Google). On Claude’s personal plans, Anthropic keeps your data for five years if you let it train its models on your chats; otherwise its usual 30-day period for keeping data applies (Anthropic).
- People may read it. Trained reviewers, some of them working for other companies, read a sample of Gemini chats. Those chats are kept for up to three years, even after you delete your activity (Google).
- It may train the company’s next AI. Depending on your settings, what you send can be used to improve future versions. Each product has its own setting, and companies don’t always explain clearly what they collect (Data Detox Kit).
- Switching history off doesn’t delete everything. With Gemini’s activity setting off, or in a temporary chat, Google still keeps chats for 72 hours and still uses them to keep the service safe, with help from human reviewers (Google).
All of it sits on servers you don’t control, under laws you may not know (Autonomía Digital). Sharing files and cloud storage has the questions to ask about whose laws apply. The clearest advice comes from one of the companies itself:
Please don’t enter confidential information that you wouldn’t want a reviewer to see or Google to use to improve our services, including machine-learning technologies.
Google, Gemini Apps Privacy Hub
That holds for every AI tool, not only Google’s.
Work accounts usually come with stronger promises. When your organisation uses Microsoft’s Copilot through its work accounts, what you type and what Copilot answers get the same protections as your organisation’s email and files, and aren’t used to train Microsoft’s AI models (Microsoft). Google says that on a Google Workspace account, your Gemini chats and files aren’t read by reviewers or used for training without your permission (Google Workspace). Claude’s business and education plans aren’t part of the training choice that its personal plans have (Anthropic).
Leaks and breaches
Anything you send is only as safe as the company that holds it. In January 2025, researchers at the security company Wiz found a database belonging to the AI company DeepSeek open to anyone on the internet, with no password needed. It held more than a million lines of records, including people’s chat histories and secret keys (Wiz). Wiz’s own conclusion was that the most pressing risks for AI services come from basic mistakes like that one, not from anything futuristic (Wiz).
So the protection that matters most is in what you choose to send. If your rules keep something off outside services, keep it out of AI tools too (TechSoup).
Protect the AI account as well. Its history records what you drafted, asked and uploaded. Turn on two-factor authentication for it, as you would for email.
The less familiar risks
Some risks are new. They come from AI tools reading things for you and acting for you.
Hidden instructions
A web page, email or document can hold text written for the AI rather than for you, sometimes invisible, such as white text on a white background (Autonomía Digital). When the AI reads it, it may treat it as an order: copying what’s on your screen and sending it to someone, or doing something you never asked for (Autonomía Digital; OWASP). This is called prompt injection. OWASP, a non-profit foundation that works on software security, says “it is unclear if there are fool-proof methods of prevention for prompt injection” (OWASP).
You can’t count on spotting it, so limit what a trick could reach. Give an AI tool only the access a task needs, and check anything it wants to send, post or pay before it does (OWASP).
AI agents
An AI agent is an AI tool that acts for you: it browses, fills in forms, sends messages or makes purchases on your behalf (Freedom of the Press Foundation; TechSoup). To do that, it needs your accounts. The Freedom of the Press Foundation’s digital security team, drawing on Signal, puts it plainly: “the risk with an agent is that it needs access to a lot of sensitive information in order to fulfill instructions” (Freedom of the Press Foundation). A shopping task alone means your name, address, phone number and card or bank details. A hidden instruction that steers the agent can then do a lot of damage with them.
You don’t have to use these features. If you do, keep them in a separate browser profile (a space in the browser with its own sign-ins) set up only for them (Freedom of the Press Foundation), away from the accounts that hold your work.
Connected apps
Assistants get more useful when you connect them to your email, calendar or files, and each connection widens what they can read and share (Google). Google warns that connecting an outside app it doesn’t monitor could expose your data, passwords, devices and accounts (Google). Connect only what a task needs, and look over the list of connected apps in your quarterly checks.
AI that’s already there
AI is also turning up inside tools you already use:
- In the browser, an AI assistant uses the address and content of the page you’re on, and any other tabs you share with it, to answer you (Security in a Box), so it sees whatever is on screen, private email included (Autonomía Digital). Security in a Box shows how to switch these features off in Firefox and Chrome. Do it in any browser you use for sensitive work; Browsing securely has more.
- On phones, Gemini can switch on by mistake, when it hears something that sounds like “Hey Google” or is tapped by accident (Google). Switch off any assistant you don’t use.
- In chat apps, WhatsApp says its AI assistant receives only what you, or others in a group, send it, and advises sending it only what you’re comfortable with it remembering (WhatsApp). A business you message may use AI to reply, and WhatsApp then tells you the chat isn’t end-to-end encrypted (Security in a Box). For a sensitive chat or group, turn on advanced chat privacy: it stops the others in it from using its messages with AI features (Security in a Box).
- In meetings, an AI note-taker is a recording. Keep them out of sensitive meetings, and remove any that join uninvited (Video calls).
How attackers use AI
Attackers use the same tools, mostly to make old tricks cheaper, faster and more convincing (Data Detox Kit):
- Cloned voices: software can copy someone’s voice from a short audio clip (Data Detox Kit). A call that sounds like your director asking for an urgent payment may not be your director. Social engineering explains how to check another way.
- Messages that feel personal: AI can write a message aimed at you from what’s posted about you online, or leaked in a breach (Data Detox Kit). The signs and the payment rule in Phishing still apply.
- Fakes made to shame and discredit: in Kenya, young women and LGBTI activists faced abuse that included AI-generated sexual images (Amnesty International Kenya). In Pakistan, the Digital Rights Foundation’s 2025 helpline report includes AI-generated fakes among the harms people brought to it (Digital Rights Foundation). Online harassment and abuse covers deepfakes (fake images, audio or video made with AI) and how to support someone targeted.
- Fakes of your organisation: voice notes or videos of your leaders saying things they never said, and fake pages using your name (SIIRF). SIIRF’s Disinformation & Fakes playbook starts with saving copies, posting a calm correction on your own channels and reporting the fakes. Agree in your incident response plan who does each.
Keeping it in proportion
None of this means your team should stop using AI, or treat every video as fake.
The human rights organisation WITNESS calls deepfakes “an evolution, not a rupture of existing problems” (WITNESS). The habits that catch other tricks catch these too: slow down, check another way and confirm before you share (Data Detox Kit). Panic does harm of its own. Once people believe anything could be fake, a true video can be waved away as a deepfake (WITNESS).
The same goes for the tools. Used with care, they can save a small team time on drafting, summarising and research (TechSoup), and they can make technology easier to use, including for people with disabilities (Autonomía Digital). Your colleagues are probably using them already (TechSoup). The aim is to use them safely, not to ban them.
Habits for using AI tools safely
Share these with your team:
- Decide by the information, not the tool. Keep the names and stories of the people you support, case files, sources, passwords and anything confidential out of public AI tools (TechSoup). If you need help with a sensitive task, take the names out or use made-up details (TechSoup).
- Use work accounts for work. Where your organisation has an AI tool on its own accounts, use that, not a personal free one.
- Switch off training and history where you can, and use temporary chats for anything you’d rather not keep, knowing a copy is still held for a while. Each company’s own page explains its settings, such as Gemini’s and Claude’s.
- Keep agents and AI browser features apart, in their own browser profile, or don’t use them.
- Connect only what a task needs, and review connected apps every quarter.
- Keep AI out of sensitive conversations: no note-takers in sensitive meetings, and advanced chat privacy on sensitive WhatsApp chats and groups.
- Check what it gives you. AI tools can produce text that sounds right and is wrong (Data Detox Kit). Someone reads anything AI wrote before it’s shared or used to make a decision (TechSoup).
- Protect the account with two-factor, like your email.
A policy starter
TechSoup puts the idea behind a good AI policy in one line:
AI is primarily a data-risk issue, not a tool issue.
TechSoup, How to create a generative AI use policy
So build your policy around kinds of information rather than particular apps, and make it part of the security policies you already have (TechSoup). One page is enough.
Agree it with your team
- Ask what people already use. Assume AI tools are already part of the work, and ask, without blame, which ones and for what (TechSoup).
- Sort those uses by the information involved, with the same levels you use for the rest of your information: public, confidential and secret (Who has access).
- Agree the page together, starting from the draft below.
- Name who to ask when someone isn’t sure (TechSoup).
- Review it at your yearly policy review, and whenever you add a tool or one changes its terms (TechSoup).
A page to start from
Change it to fit your team:
- Public information, meaning anything we’ve published or would publish, can go into any AI tool.
- Confidential information, such as internal documents, budgets and partners’ details, goes only into the AI tools we’ve approved, through our work accounts.
- Secret information never goes into an AI tool: the names, contact details and stories of the people we support, case files, sources, passwords and keys.
- This covers what we ask as well as what we paste, since a question can give away a plan.
- Approved tools: list each one, the account to use and who manages it. Training is switched off in each.
- No AI note-takers in sensitive meetings. Anyone can remove one that nobody invited.
- AI agents and AI browser features stay off wherever we handle work email, money or case files.
- A person checks anything AI wrote before it goes out or shapes a decision, and we say when AI helped (TechSoup).
- Unusual requests by voice or video, especially for money or codes, are checked another way, however real they sound (Social engineering).
- If we’re not sure, we ask the champion first.
Bringing in an approved tool
Bring an approved AI tool in the way you would any other. Try it with one or two people first. Then set it up together in a short session, on work accounts, with training off and nothing connected that isn’t needed. Offer one-to-one help to anyone who wants it, and answer questions in the team chat. Close access when someone leaves, and check every quarter that the settings have held. Training your team has a session shape you can use.
Where to go next
- Security policies: fold the AI page into your other agreements.
- Who has access: sort your information into the levels the policy uses.
- Sharing files and cloud storage: where your files live, and whose laws they fall under.
- Training your team: run a short session on these habits.
- SIIRF’s Disinformation & Fakes playbook: if a fake of your organisation appears.