Artificial intelligence is no longer a promise: it summarises emails, drafts text, extracts data from invoices and answers frequently asked questions. For a small business, that can mean hours saved every week.
But there is a problem many people ignore: where does the data you paste into the AI go?
The risk nobody sees
When someone on the team copies a customer email, a contact list or a contract into a free AI tool, that data leaves the company. Depending on the service and the account settings, it may be stored and even used to train future models.
If that data is personal — names, emails, tax numbers, addresses, health data — it is a GDPR matter. And the responsibility lies with your company, not the tool.
Rule 1: keep personal and business accounts separate
Free and personal versions of AI tools follow different rules from business versions and APIs. Many providers do not use data from business accounts or the API to train models by default — but always check the terms of the service you use.
In practice:
- use company accounts, not each employee’s personal account;
- check the settings to see whether your data can be used for training and switch it off where possible;
- prefer providers that offer a data processing agreement (DPA).
Rule 2: you do not need to give the AI everything
For many tasks the AI does not need to know who the customer is.
- To improve the wording of an email, replace the name with “[customer]”.
- To analyse a sales sheet, remove the columns with names and contact details.
- To summarise a contract, strip out the identifying details.
Less data sent, less risk.
Rule 3: a person always reviews
AI writes confidently even when it is wrong. Before sending an email to a customer, publishing a text or making a decision based on a summary, someone has to read and approve it. The AI drafts; the responsibility stays human.
Rule 4: set out what is and is not allowed
One page is enough. Something like:
- Allowed: drafts, summaries of internal documents without personal data, ideas, copy editing.
- With care: customer emails (without identifying details), analysis of anonymised data.
- Not allowed: health data, customers’ financial data, passwords, confidential documents in unapproved tools.
Where AI pays off most in a small business
- Answering frequent questions on your website or WhatsApp, with answers you have approved.
- Triaging requests that arrive by email and routing them to the right person.
- Extracting data from documents — invoices, orders, forms — into your system.
- First drafts of proposals, product descriptions and posts.
The key is building AI into your processes, with the right rules, instead of everyone using it their own way.
How we work at Lumbra
We use AI as a tool to build faster and test more. Decisions, design and final review are always done by people, and client data never goes to services that use it to train models.
When we build AI into a custom application, we do it with business accounts, only with the data that is strictly needed and with a person approving what matters.
Want to find out where AI could save your business time? Let’s talk.
