Keep Customer Info Out of the Chatbot Without Giving Up on AI

It's 7:40 on a Monday. Your office manager is trying to get ahead of the day, so she copies last Friday's whole job sheet into a free AI chatbot and asks it to write the follow-up texts. That sheet has eleven customer names, home addresses, two gate codes, a phone number for somebody's elderly mother, and the last four of a card on file. The texts come out great. Nobody stops to think about where that sheet just went.

This note is for owners and office folks at small trade shops (HVAC, plumbing, electrical, auto, and small retail counters) who have started using AI for texts, notes, and estimates. The problem is simple: the fastest way to use AI is to paste everything, and "everything" includes your customers' private details. The fix isn't to quit using AI. It's a one-page rule for what goes in and what stays out, plus a habit of swapping real details for job numbers before you paste. AI still does the wording. You still keep the customer file.

What usually gets pasted that shouldn't

Most of it isn't careless. It's just what's sitting on the job sheet when you're in a hurry:

• Card numbers, bank info, and check images, even partial ones
• Gate codes, alarm codes, lockbox codes, and "key is under the mat" notes
• Full names with home addresses, especially for elderly or vacation-away customers
• Driver's license or Social Security numbers from credit applications or new-hire paperwork
• Employee details like pay rates, write-ups, or medical notes

None of that helps the AI write a better text. It only adds risk.

A one-page "what goes in, what stays out" rule

Put this on one sheet and tape it by the office computer. Keep it short enough that people actually read it:

• Okay to paste: job type, the problem in plain words, parts used, your prices and policies, your own shop rules, and a job or ticket number
• Swap before pasting: customer name becomes "the customer," address becomes the neighborhood or zone, phone becomes "their cell"
• Never paste: card or bank numbers, any codes, license or Social Security numbers, employee pay or personnel notes
• When unsure: leave it out and fill it in by hand after the AI gives you the draft

The draft text says "Hi [NAME], your tech is on the way to [ADDRESS]." Your office fills in the blanks inside your own texting or job system, where that information already lives.

Let AI help you clean the notes first

You can even use AI to help you strip the details out, as long as you do it on text you've already trimmed. A prompt like this works for a messy tech note:

"You help a small HVAC, plumbing, or electrical shop in Louisiana. Rewrite this tech note so it's clear for the office. Replace any person's name with [NAME], any street address with [ADDRESS], any phone number with [PHONE], and any code or number that looks like a password, card, or ID with [REMOVED]. Don't add details that aren't in the note. Keep it under 120 words in plain shop language."

Then read what comes back before it goes anywhere. AI can miss things, so the person pasting is still the last check.

Check the tool's own settings once

Before your shop leans on any AI tool, spend fifteen minutes on its settings and privacy page. Look for whether your chats can be used to train the tool, whether you can turn that off, and whether there's a business or team version with different terms. Write down what you chose and who has the login. If the answers are hard to find, that's a reason to be even stricter about what you paste.

Why this matters for a small shop

The FTC's Protecting Personal Information guide boils data safety down to five plain steps: know what you have, keep only what you need, lock it up, throw it out properly, and plan ahead. A "what stays out of the chatbot" rule is really just the "keep only what you need" step applied to a new tool. The SBA's section on strengthening your cybersecurity points out that employees and everyday work messages are a common way into small business systems, and lists protecting customer and vendor information as a training topic. The SBA's AI for small businesses section recommends starting small and reading up on both the benefits and the risks. And if customer data ever does get out, the Louisiana Attorney General's data breach notification page explains when and how businesses notify the AG's office under the state's breach law. It's worth knowing that page exists before you ever need it.

A small, low-risk way to start

Don't write a forty-page policy. This week, take one sheet of paper and write the three lists above in your own words. Show it to everyone who uses AI at the shop and ask them to try it on just the follow-up texts for five days. At the end of the week, look at what got pasted and adjust the lists. If someone finds the swapping slows them down, make the placeholders shorter, not the rule looser.

If you'd like help writing a one-page AI rule that fits how your office actually works, plus a few safe prompts your team can reuse, you can book a short call and we'll build it from your real job sheets with the private details left out.

Sources & useful links

• FTC: Protecting Personal Information, A Guide for Business. The FTC's plain five-step approach to keeping customer and employee data safe: take stock, scale down, lock it, pitch it, and plan ahead.
• SBA: Strengthen your cybersecurity. SBA guidance on common threats, staff training topics, and basic steps like strong passwords and multi-factor sign-in.
• SBA: AI for small businesses. The SBA's overview of AI benefits and risks, with advice to start small and test tools before relying on them.
• Louisiana Attorney General: Data Security Breach Notification. How Louisiana businesses report a data breach to the AG's Consumer Protection Section when the state's breach law requires notice.