AI Privacy and Safety Checklist: Before You Use Any AI Tool

By the aixplor.in editors · Updated 2 November 2026 · 8 min read

Every time you paste something into an AI chatbot, upload a file to an AI editor or install an "AI helper" extension, you are handing data to a company. Usually that is fine. Sometimes it is a serious mistake that can't be undone.

This checklist is for anyone using AI tools at work, at home or at school. It is written to be printed, shared with your team or kept open in a tab. Work through it once for each new tool, and revisit it when a tool changes its terms.

The 60-second version

Before you use any AI tool, answer these five questions:

1. Who made this tool, and is it the real one?
2. Would I be comfortable if what I'm pasting became public?
3. Does this tool use my inputs to train its models, and can I turn that off?
4. Am I using a personal account for work data?
5. What permissions does this app or extension ask for, and why?

If any answer makes you uneasy, stop and read the relevant section below.

1. Data you should never paste into an AI tool

Treat any consumer AI chat like a conversation that could be stored, reviewed by staff for safety, or exposed in a breach. Never paste:

• Passwords, PINs, OTPs, recovery codes or API keys. No legitimate AI tool needs them in a chat.
• Government ID numbers: Aadhaar, PAN, passport, voter ID, driving licence, or scans of these documents.
• Financial details: card numbers, bank account and IFSC details with names, UPI PINs, full bank statements.
• Health records: reports, prescriptions or diagnoses linked to a named person, including family members.
• Other people's personal data: customer lists, employee records, student marks, contact sheets, CVs from applicants.
• Confidential work material: unreleased financials, source code under NDA, legal documents, contracts, pitch decks, board papers.
• Private conversations: screenshots of WhatsApp chats or emails that include other people, unless they have agreed.

Safer ways to get the same help

• Redact first. Replace names with "Client A", numbers with "XXXX", and remove addresses before pasting.
• Describe instead of uploading. "Write a polite payment reminder to a client who is 30 days late" works without the actual invoice.
• Use synthetic examples. Make up sample data that has the same shape as your real data.
• Use approved enterprise tools for real work data (see section 3).

2. Training and data-retention settings

Most major AI chat tools let you control at least some of how your data is used, but the defaults vary and change. For every tool you use regularly, find and check these settings:

• Model training: Is there a toggle to stop your chats being used to improve models? In ChatGPT, Gemini, Claude and Microsoft Copilot, look in settings under data controls, privacy or activity.
• Chat history: Can you turn history off or use a temporary chat mode? Note that "off" may still mean data is kept for a limited period for safety review.
• Retention period: How long are chats and uploaded files stored after you delete them? Check the privacy policy.
• Human review: Does the policy say staff or contractors may read conversations? Some services say so explicitly.
• Connected apps: Have you linked email, Drive, calendar or other accounts? Each connection widens what the AI can see. Remove the ones you don't use.
• Memory features: If the assistant "remembers" facts about you, review and delete stored memories periodically.
• Shared links: Have you created public share links to chats? Revoke old ones.
• Export and delete: Do you know how to download your data and delete your account?

Settings move around after app updates. Recheck them every few months, and read the current privacy policy rather than relying on blog posts (including this one).

3. Team accounts vs personal accounts

Rules for workplaces

• Don't use personal AI accounts for company data unless your employer explicitly allows it. If something leaks, it is you who carries the risk.
• Ask IT or your manager which tools are approved. Many companies now have an AI-use policy. If yours doesn't, suggest one.
• Check where data is stored if you handle regulated data or work with clients who require data to stay in particular regions.
• Keep client confidentiality. Contracts with clients may forbid sharing their data with third-party services, AI or otherwise.

4. Browser extensions: the hidden risk

AI browser extensions are convenient: summarise this page, rewrite this email, transcribe this meeting. They also often request permission to "read and change all your data on all websites." That can include your webmail, banking pages and internal company tools.

Checklist before installing any AI extension:

• Is it published by the official company (for example, the real Grammarly or a major AI lab), not a lookalike name?
• Does it have a real website, a privacy policy and a named company behind it?
• Are the permissions it requests proportionate to what it does?
• Has it been recently updated, and do recent reviews mention problems?
• Can you restrict it to specific sites ("on click" or "on specific sites" in browser settings)?
• Do you actually still use it? Remove extensions you haven't used in a month.

Extensions can also change owners and be updated silently. A safe extension today can become a data-harvesting one later, so keep your list short.

5. Fake "AI" apps and AI scams

AI popularity has created a wave of imitation apps and scams. Watch for:

• Lookalike apps in app stores using names like "Chat GPT AI Pro" with heavy subscription charges. Download apps only via links from the official website.
• Fake ads and pages offering "free premium AI" downloads that install malware. Real AI chat tools work in the browser and rarely need a desktop download from an ad.
• AI investment schemes promising guaranteed returns from "AI trading bots." Treat any guaranteed-return claim as a red flag.
• Voice-clone calls imitating a relative or boss asking for urgent money. Hang up and call back on a known number.
• Deepfake videos of celebrities or business leaders endorsing products or schemes.
• Fake job offers asking you to "train AI" after paying a registration fee.

If you are scammed in India, report it promptly on the national cybercrime portal (cybercrime.gov.in) or the 1930 helpline, and contact your bank immediately.

To find genuine tools, start from the official sites listed in our categories, and compare options on pages like ChatGPT alternatives and Gemini alternatives.

6. Kids and teenagers using AI

Most mainstream AI chatbots set a minimum age in their terms, commonly 13 with parental consent for younger teens, and some set it higher. Check each tool's terms. Practical guidance for parents and teachers:

• Use the tool together first and talk about what it is: a prediction machine that can be confidently wrong.
• Teach the "never paste" list above, especially full name, school, address, photos and phone numbers.
• Explain that AI companions and character chatbots are not friends or therapists, and that kids should tell an adult if a conversation becomes upsetting or inappropriate.
• Turn on family or education settings where available, and prefer tools designed for learners, such as Khanmigo, for schoolwork.
• Agree on homework rules: what AI help is allowed, and that school policies come first.
• Keep devices in shared spaces for younger children.

7. India's DPDP Act at a high level

The Digital Personal Data Protection Act, 2023 (DPDP Act) is India's main data protection law, with implementing rules being rolled out in phases. At a high level, and without being legal advice:

• It applies to digital personal data of people in India, and to some processing outside India connected to offering goods or services here.
• Organisations ("data fiduciaries") generally need a lawful basis such as consent, must give clear notice, collect only what they need, protect it, and delete it when no longer needed.
• Individuals ("data principals") get rights such as access, correction and erasure, and grievance redressal.
• There are specific obligations around children's data, including verifiable parental consent.
• Significant penalties can apply for failures such as inadequate security safeguards.

What this means for everyday AI use: if you are a business, pasting customers' or employees' personal data into an AI tool is processing that data, and your DPDP obligations travel with it. Check your contracts with AI vendors, update your privacy notice if needed, and minimise personal data in prompts. For anything beyond basic awareness, check with a lawyer familiar with Indian data protection law. You can also read how aixplor.in itself handles data on our privacy page.

Printable checklist

Before using a new AI tool:

• I got it from the official website or verified app store listing
• I have read what it does with my data, at least the summary
• I have checked training, history and memory settings
• I am using the right account (work data in an approved work account)
• I have removed names, IDs, numbers and confidential details from what I paste
• Any extension has limited permissions and a known publisher
• I will verify important outputs before acting on them
• I know how to delete my data and my account

Bottom line

AI tools are safe enough for most everyday tasks if you control what goes in. Redact before you paste, check training settings once, keep work data in approved work tools, prune your extensions, and download apps only from official sources. For prompt ideas that work without personal data, browse our prompts library.

Tools and plans change often — always check each product's own website for current features, pricing and terms. aixplor.in is independent; listings and rankings are not paid placements.