In One Sentence
When you use ChatGPT, Claude or any AI, your data leaves your machine: it's processed on remote servers, sometimes stored, sometimes used to train other models. Here's how to stay in control without giving up on AI.
🇫🇷 Want AI hosted in Europe?
Discover Mistral Le Chat: free, native French, servers in France, GDPR-friendly.
What happens when you send a message to an AI?
The lifecycle of a message sent to a chatbot
You write your message
The text is encoded and sent via HTTPS to the provider's servers.
The model processes
Your data passes through the LLM, generates a response.
Temporary storage
The conversation is generally kept for at least 30 days (logs, support, moderation).
Possibility of training
Depending on settings, may be used to improve future models.
The critical point: between steps 2 and 4, your data is readable by certain people (moderators, security teams, sometimes subcontractors).
The 3 risk levels
Which uses, which risks?
| ✅Low risk | 🔴High risk | |
|---|---|---|
| Brainstorming generic ideas | OK | — |
| Writing a job application email | OK | — |
| Translating public text | OK | — |
| Learning a technical concept | OK | — |
| Pasting a confidential client contract | — | To avoid |
| Asking advice on a medical file | — | To avoid |
| Pasting personal data (customers) | — | To avoid |
| Submitting sensitive proprietary code | — | To avoid |
GDPR and AI: what you need to know
If you're in Europe (or your users are), GDPR applies. Here are the 3 key principles:
1. Legal basis
You need a legal basis to process personal data with an AI. Common bases:
- Explicit consent from the person
- Legitimate interest (e.g. analysing your own emails)
- Contract (e.g. commissioned customer support)
2. Transfers outside the EU
ChatGPT, Claude, Gemini: their servers are mainly in the US. EU→US transfers must be regulated (Data Privacy Framework, standard contractual clauses).
To stay in the EU: Mistral (French), Aleph Alpha (German), or self-hosted deployment.
3. Individual rights
If you use AI to process other people's data (customers, employees), they have rights:
- Information: tell them their data goes through an AI
- Access: let them see what's being processed
- Deletion: be able to erase their data
How to protect yourself: the 5 essential reflexes
📚Best practices in detail
1. Disable training in settings
ChatGPT: Settings → Data Controls → "Improve the model for everyone" → OFF
Claude: You can ask Anthropic via the support form, or directly use Team/Enterprise versions (which never use your data).
Gemini: myactivity.google.com → activate "Pause" on Gemini Apps Activity.
Mistral: Le Chat doesn't train on your conversations by default.
2. Anonymise before submitting
If you need to process text containing names/emails/phone numbers, replace them with placeholders:
- "Jean Dupont" → "[CLIENT_A]"
- "jdupont@gmail.com" → "[EMAIL]"
- "06 12 34 56 78" → "[TEL]"
The AI will process the text normally. Then you reform it with a simple find/replace.
3. Use temporary conversations
ChatGPT and Claude offer a "temporary conversation" mode (the special icon in the chat) that doesn't save anything.
Use for: anything containing slightly sensitive info, even if not confidential.
4. Prefer Team/Enterprise offerings for professional use
Professional offerings (ChatGPT Team, Claude for Work, etc.) have contractual commitments:
- No training on your data
- Time-limited storage
- GDPR compliance (DPA signed)
- Security audit (SOC 2, ISO 27001)
It's ~£25-30/month/user, but it's mandatory for serious professional use.
5. For critical cases: local execution
You can run LLMs directly on your computer: your data never leaves.
Tools:
- Ollama (ollama.com), install Mistral, Llama, DeepSeek in 1 command
- LM Studio (lmstudio.ai), simple graphical interface
- Jan (jan.ai), open-source alternative
Performance: a MacBook M2/M3 runs 7B-13B models very well. Not as powerful as GPT-5, but more than sufficient for 80% of uses.
The decision table: which tool for which use?
Choosing according to data sensitivity
| 📝Low-sensitivity data | 🔒Sensitive data | |
|---|---|---|
| Recommended tool | ChatGPT/Claude/Gemini free | Mistral, Team/Enterprise, or local |
| Setup | Disable training | DPA + GDPR mandatory |
| OK uses | Brainstorm, personal, public | Customer data, medical, proprietary code |
| Cost | Free | £25-30/month/user OR local |
Providers compared on privacy
Privacy score (our assessment)
Methodology: score based on EU/US transfers, training opt-out, storage duration, GDPR certifications.
Case studies
📚5 common situations and the right answer
1. "I want to summarise a PDF received from a client"
If the PDF contains personal data (names, addresses, contacts) or trade secrets:
- ❌ Not in free ChatGPT
- ✅ ChatGPT Team/Claude for Work with signed DPA
- ✅ Or locally (Ollama + Mistral)
If the PDF is public (market report, white paper):
- ✅ Any tool
2. "I want ChatGPT to correct my CV"
The CV contains your name, email, background = your own data, but public (LinkedIn).
- ✅ OK in any chatbot
- ⚠️ Disable training anyway
3. "I want to ask a medical question"
- ❌ Never paste a real medical report
- ✅ Rephrase generically: "Someone with X symptoms, what might they have?"
- ⚠️ And always consult a real doctor, AI is not qualified
4. "I want AI to help with my code"
If the code is proprietary (company):
- ❌ Not in GitHub Copilot personal without employer agreement
- ✅ GitHub Copilot Business (no-training commitment)
- ✅ Or Cursor/Claude Code Enterprise
If the code is open source or personal:
- ✅ All tools OK
5. "I want to scrape a website and summarise with AI"
- ⚠️ Check the site's ToS (often prohibited)
- ⚠️ Don't use scraped personal data
- ✅ For truly public data (Wikipedia, institutional sites), it's OK
The classic mistake: the "it stays between us"
The metaphor that sums it all up
Essential takeaways
- ✅ Disable training in the settings of all your chatbots
- ✅ Anonymise names/emails/phone numbers before submitting
- ✅ For professional use: Team/Enterprise offerings mandatory
- ✅ For critical use: local execution (Ollama, LM Studio)
- ❌ Never: passwords, medical data, industrial secrets in clear text
AI is a fantastic productivity tool, but not a confessional. Learn the right reflexes, and you can enjoy it with peace of mind.