Chapter 5
The Account Rule
Read the box.
This is the one Deb skips.
You've been asking the wrong question. Everyone does. It's never can I put the real stuff in — it's which version of the tool am I standing in, and did anyone at work actually say yes. Same tool. Same prompt. Same you. Two completely different risk levels, decided entirely by which door you walked through to get there. That's the rule. That's the whole chapter. The rest is just me making sure you believe me.
Here's what makes it make sense, and it has nothing to do with how friendly the tool looks. It's about who's paying. When the tool is free, the product is you — specifically, everything you type into it. Free tools get smarter by reading the room, and you're the room. When a company pays real money for a licence, the company becomes the customer, and companies have lawyers, and lawyers do not let your data go walkabout into someone's training set. So the safe version is usually the one with an invoice attached — not because it's fancier, but because somebody sat in a meeting and negotiated it.
⚑ Personal vs. company account — the rule
Personal or free account. Assume every word may be quietly going into the model's education unless you've dug into the settings and switched it off — and assume you haven't, because nobody builds a cheerful welcome screen designed to talk you out of the thing that helps them. So the real names stay out. Change them, blur them, summarize the situation instead of pasting the email. A personal account is a group chat that screenshots itself: lovely for thinking out loud, a catastrophe for anything you'd lower your voice to say in an open-plan office.
Company-approved account, within policy. Plot twist nobody sees coming: in the right account, the real work is the entire point. Business and enterprise versions are usually built like a proper office with locks on the doors — no training on your data, the compliance paperwork handled, an actual contract that lets your client's name exist in the chat. But say the two words slowly, because people adore skipping one. Approved means a human with the authority to decide looked at this exact tool and said yes — not "everyone uses it," not "it was already on my laptop." In policy means that even then, there's a short list of things you still don't type: regulated data, or whatever a client locked behind an NDA. An unlocked door is not a personal invitation to every room in the building.
Not sure which one you're in? Then it's the personal one. That's not pessimism, it's the safe default — keep it vague, keep it anonymized, and go find out before you paste a single real thing. Ask IT. Ask Legal. Ask the security person whose name you can never quite remember. Pull up the approved-tools list. And do not fall for the oldest trick in the building: logging in with your work email does not make it the work account. On my work laptop, at my work desk, in my work tab — none of that makes it approved. The account type lives in a contract you've never read, not the address bar you're staring at. "I wasn't sure, so I asked" is a sentence that has never once ended a career. "I figured it was probably fine" has ended several.
And you can't count on an undo. This is the part that should genuinely slow your hand down. An email, you can unsend. A post, you can delete. But once the real thing is sitting in the wrong account, getting it back is somebody else's call, not yours — buried in retention settings, support tickets, and "we'll look into it," with no guarantee at the end. Some tools let you delete history or scrub what gets kept; some don't; most won't move as fast as your regret. So you treat it as one-way on purpose — not because erasing is always impossible, but because you cannot count on it, and "I'll just delete it after" is not a plan you'd stake your job on.
Fast is not the same as safe, and Elle Woods is the proof. She didn't win the case by sprinting into the courtroom or talking the loudest once she got there. She won on a single detail the entire room thought was beneath them — that you physically cannot wash a fresh perm the same day you get it — because she was the only one who bothered to learn the rule everyone else found too silly to know. The slow, unglamorous, read-the-fine-print move is the one that wins. Almost no career-ending afternoon in recorded history began with the words "so I took the approved route."
Don't be Deb
Which brings us, inevitably, to Deb. Deb does not read the box. Deb pastes the entire client deck — logos, numbers, the slide still stamped CONFIDENTIAL in the footer — straight into her personal account, because the approved one logged her out one time in 2023 and she has nursed the grudge ever since. Deb assumes the privacy setting is "probably fine." Deb has never opened the privacy setting. Deb thinks "within policy" is a kind of insurance.
Don't be Deb.
Read the box.