A contractor can safely paste generic wording, public tender text and their own draft emails into ChatGPT. Redact first: client names, addresses, prices, rates and contract terms. Keep out: security codes, alarm and camera details, keys, personal data about staff or clients, bank details and anything a contract marks confidential.
The rule behind the lists is a question to ask before every paste: would I be comfortable if this text appeared on a competitor's or a client's screen? If the answer is no, redact it or leave it out. The setting changes and the three lists below turn that question into something a site office can follow without thinking.
What actually happens to text you paste
When you paste text into ChatGPT it travels to OpenAI's systems, is stored in your chat history until you delete it, and may be kept for a period after deletion for safety reasons. On personal plans (Free, Go, Plus and Pro) OpenAI's help centre says data sharing for model improvement is on by default, controlled by a setting called Improve the model for everyone. On business plans, OpenAI says content is not used for training by default. Setting labels change, so check them on the day.
That matters for construction because your documents are rarely yours alone. A tender contains a client's brief, a subcontract contains a trade's rates and a site plan shows where valuables are kept. Pasting these without a thought can breach a confidentiality clause, give away pricing or expose a site, even though the tool itself works exactly as designed.
Safe, redact-first and never-paste: the three lists
Keep this table in the site office and the back office. Every document type a small contractor handles falls into one column.
| Safe to paste | Redact first | Never paste |
|---|---|---|
| Your own draft emails with names removed | Client emails, with name, address and project name swapped for placeholders | Alarm codes, door codes, key safe numbers |
| Public tender questions and published scoring criteria | Tender documents the client marked confidential | Site security plans, camera positions, valuables stores |
| Generic method wording with no site detail | Method statements that name the site and the plant | Personal data: staff records, medical details, ID numbers |
| Anonymised meeting notes | Meeting notes with attendee names and commercial positions | Bank details, payment account numbers, passwords |
| Published standards headings and public guidance you quote yourself | Quotes, rates and margins (use ranges or placeholders) | Whole contracts or subcontracts under a confidentiality clause |
| Your own marketing copy | Snag lists and site reports that identify the occupier | Anything the client or contract says must not leave the project |
The middle column is where most of the daily decisions happen, and it is the one people get wrong because redaction feels like work. The next section shows that it is under two minutes.
The Complete Excel Course with AI Integration
From formulas and pivot tables to Power Query, DAX, VBA and AI with Copilot, ChatGPT and Claude — hands-on from the first lesson.
By Sagnik Bhattacharya and Virginia Thorn, Primetime Emmy Award winner
Buy nowA worked redaction: from a client email to a safe prompt
Illustrative case. A six-person building firm gets an email from a homeowner asking for a quote on a loft conversion and mentioning that the house is empty from Thursday to Sunday each week. The office manager wants ChatGPT to draft a reply asking for the missing details. Pasted unredacted, the prompt would include the client's name, the street address, the phone number and the sentence about the house being empty, which is a security detail.
ORIGINAL (do not paste)
Hi, I'm [Name] at 14 [Street]. We want a loft conversion, two bedrooms,
roughly 6m x 4m, budget around $55,000. We're away Thu to Sun every week
so the house is empty then. Key safe code 4471. Phone [number].
REDACTED (paste this)
Client email: wants a loft conversion, two bedrooms, roughly 6m x 4m.
Budget stated. Client is available at set times in the week.
Write a reply asking for: drawings if any, preferred start month,
whether planning approval has been sought, and a time for a site visit.
Friendly, under 120 words, signed [your name]. Use [client first name].Notice what moved. The street, name, phone and key safe code disappeared, the budget became "stated" and the empty-house detail was reduced to "available at set times". The model has everything it needs to write the reply, and nothing that would hurt if it leaked. The redaction took about 90 seconds. The sample reply the model returns is a 90-word email with four questions and a placeholder, which the manager personalises and sends. The key safe code goes into the client file where it belongs, never the prompt.
A subtle point: the budget. If the firm prices competitively, even "around $55,000" is commercial data, and the safe form is "budget stated, within our usual range". Decide a firm-wide habit rather than leaving it to each person.
Pricing and rates: the information competitors would pay for
Day rates, margins, supplier discounts and tender prices are the most valuable content a contractor holds, and the one most often pasted. A request such as "make this quote sound better" with a full price schedule in it puts your rates into a third party's systems. The better habit is to paste the wording only, with rates as placeholders such as [rate], and put the numbers back yourself.
Say a four-person roofing company wants a polished scope paragraph. The prompt contains the work description and "price: [total]", and the owner types the real figure afterwards. If you need the model to reason about prices, for instance to check that line items add up, use your spreadsheet instead: sums belong in a spreadsheet, and the model is poor at arithmetic anyway. For pricing work specific to variations, see how small builders price variations and change orders.
Contracts and subcontracts: check the clause before the paste
Many construction contracts and tender documents carry a confidentiality clause covering project information and sometimes the contract itself. Pasting the document into a chatbot may breach it, whatever your privacy setting says. Before you paste any contract, read its confidentiality wording, and if it is unclear, ask the client or take advice from a solicitor.
A safer workflow for a clause you do not understand: copy only the clause, strip names and project references, and ask for an explanation in plain English, then take the result to a person with legal training. That gives you a reading aid, not advice. Tools built for contract review have their own terms and retention rules, so check those too, as covered in the contract review software tutorial.
Site security details: the cleanest never-paste rule
This is the easiest rule to enforce because there is no judgement call. Alarm codes, key safe numbers, gate codes, camera positions, where tools or copper are stored, when the site is empty and where keys are held are never pasted, in any form, to any tool. A site diary line like "gate code changed to 8820, ring site manager" has no business in a prompt.
The realistic mistake is an admin pasting a whole email chain to get a summary, with a code buried in the third message. Defences: a rule that email chains are never pasted whole, a habit of reading the paste window before sending, and a rule that codes are shared by phone or a password manager, not in email. If a code has been pasted, change it. Do not rely on deleting the chat.
People's data: staff and clients
Staff records, sickness details, disciplinary notes, right-to-work documents, bank details and home addresses are personal data. Client personal data, such as names, phone numbers and home addresses, falls into the same category. Data-protection law such as the GDPR may apply if you handle information about people in the EU, and the safest practice is to keep personal data out of consumer chat tools altogether and use anonymised descriptions. For example, "an employee with three absences this quarter" instead of a name and dates.
If you have a genuine need, such as drafting a letter about a performance issue, use a placeholder for the name, remove medical detail and keep the case notes in your HR system. The wider guidance in keeping customer data private when your team uses AI applies here directly.
Photos, drawings and files
Image and file uploads carry hidden content. A site photo can show a neighbour's face, a car number plate, a camera on a wall or the alarm box by the door. A drawing may hold the client's name, address and project number in the title block, plus layers or comments you did not mean to share. A PDF can carry metadata with author names and file paths.
Habits that cost seconds: crop to the defect, blur anything identifying, and for drawings crop out the title block or export a clean extract. If you ask the model to describe a photo for a report, keep the description of what is visible for you to check, since it can misread what it sees. Never ask it to confirm a structural or safety condition from a photo.
Privacy setting steps on a personal plan
On Free, Plus or Pro, the steps for the training setting are: open your account menu, choose Settings, choose Data controls, then find Improve the model for everyone and switch it off. OpenAI's help page says this keeps your chat history, so turning it off does not delete anything. It applies across web and mobile when you are signed in. Labels change, so check OpenAI's current Data controls page. That page, updated at the end of October 2026, also describes a Trusted Access case in which chats may still be used for training with the setting off, which is one more reason the never-paste list does not depend on the switch.
For a one-off sensitive-ish chat, a Temporary Chat does not appear in history and is not used to improve models, though OpenAI says it may be kept for up to 30 days for safety, and it can still draw on your saved memory unless you pick its Unpersonalized option. Treat it as a mitigation, not permission. Separately, review chat history and delete conversations you no longer need, and use a work account rather than a personal one so a leaver does not take the history with them.
On a business plan, content is not used for training by default and an admin can manage workspace settings. Two practical cautions apply: check what happens when someone leaves, because OpenAI says a removed member's chats are kept and workspace owners cannot see them, and there is no self-service export of the workspace; and do not assume a business plan makes your never-paste list safe. A plan changes how the provider treats text, not what your client's contract allows you to share.
A second redaction: a subcontractor's price breakdown
Rates are the hardest redaction because the numbers are the point. Illustrative case: a cleaning company that takes post-construction clean contracts receives a main contractor's breakdown listing five areas with day rates and a total of $9,600. The owner wants help writing a polite request to reduce the price by about 8%. The prompt does not need the figures.
Context: we are a subcontractor asked to reduce our price for a
post-build clean by a small percentage. We can reduce by changing scope
(for example fewer visits or no window cleaning) but not by cutting
rates. Draft a reply of under 130 words that offers two scope options
and asks which they prefer. Tone: friendly, firm. Use [client first name]
and [your name]. No figures.The model returns a clean reply offering "Option A: one fewer visit" and "Option B: external windows excluded". The owner types in the real numbers afterwards. The reply costs nothing in confidentiality, and the numbers never left the office. The principle: ask for structure and tone, add figures yourself.
When a paste goes wrong: a five-step response
Someone will paste something they should not have. The response decides whether it is a small incident or a bad one. The steps, in order, take about 20 minutes.
- Stop and tell the office manager straight away. Speed matters more than embarrassment, so make "tell me within the hour" the rule and do not punish honest reports.
- Identify what was pasted: a code, a name, a price or personal data. Decide which of the never-paste or redact-first categories it falls in.
- Remove what you can: delete the chat, and on a personal plan check that model training is off. Deletion does not guarantee the text is gone from every system, which is why step four comes next.
- Act as though the information is exposed. Change any code. If personal data was involved, note the details and take advice on whether you must tell anyone, since duties vary by case and by contract.
- Record what happened and what you changed in the job file, and update the rule if the cause was a gap in it.
Illustrative example: an admin pasted an email chain with a site gate code into a summary prompt. The code was changed the same afternoon and the chain was never pasted whole again. The cost was ten minutes and a phone call to the site team, which is much cheaper than finding out later.
Client clauses on AI: read them before the first project
Some clients include wording about artificial intelligence in tender documents and contracts, ranging from a request to disclose use to a ban on putting project information into public AI tools. A contractor should look for three things in each new contract: any confidentiality clause covering project data, any clause that names AI or automated tools, and any requirement about where data is stored.
If the wording bans public tools, you can still use ChatGPT for your own firm's work, such as marketing and internal emails, provided no project information goes in. If it requires disclosure, a short line in the tender response is enough: "We use AI tools to help draft documents; a named person checks everything before it is issued, and we do not enter project-confidential information into public tools." Do not promise more than you do. A promise that staff break is worse than no promise, so write what you can enforce.
Choosing between a personal plan, a business plan and a different tool
The plan you use changes your options but not your lists. A personal plan costs less, but you carry the risk that staff use their own accounts and leave with the history. A business plan gives an admin one workspace, removed-member controls and no training on content by default, listed at $20 a user a month billed annually or $25 monthly, with a two-seat minimum, as of October 2026; check the current pricing page on the day. A firm of five or ten people who use ChatGPT weekly usually benefits from a shared workspace for that reason alone.
Some contractors prefer tools with no chat history at all, or software hosted within their own systems. Those carry their own costs and setup, and they still need your lists, because the question of what is allowed to leave the project does not depend on the tool. Ask each vendor three things in writing: whether content is used for training, how long it is kept and who at the vendor can read it. Keep the answers with your records.
Making the rules stick in a ten-person firm
Print the three-column table, put it by the office computers and add a line to the induction checklist. Choose one person, usually the office manager, as the owner of questions such as "is this OK to paste?" so nobody guesses. Agree a short wording for client contracts and tender submissions if you use AI, and check what clients require; some public-sector clients ask.
A monthly five-minute spot check works well: the office manager scrolls through recent chat titles on the shared work account and looks for anything that sounds like it belongs in a never-paste list. When one turns up, treat it as a learning event, change any exposed code and remind the team of the rule. You are building a habit, not hunting for blame.
Once the data rules are settled, move to the actual work: eight office jobs a construction firm can hand to ChatGPT. If you want the written version for your handbook, the AI usage policy tutorial gives a template, and what to check in an AI tool's privacy policy helps with any other tool you adopt.
Quick decisions: ten real-looking pastes, sorted
Practice sorts faster than rules. Here are ten pastes a contractor might consider, with the call a careful office manager would make. They are illustrative.
- A published tender question about waste management: safe.
- Your own toolbox-talk handout, with no site name: safe.
- A subcontractor's price breakdown: redact the name and use placeholders for the rates, or keep out.
- An email chain with a client dispute: summarise it yourself first; paste only the neutral facts.
- A client's drawing set: keep out, unless the client agrees and the title blocks are removed.
- A photo of a defect with a neighbour's window visible: crop first.
- Payroll spreadsheet: never.
- Your own marketing paragraph: safe.
- A site induction pack that includes the gate code: remove the code, then safe.
- The full subcontract with a confidentiality clause: keep out; paste an anonymised clause if you need an explanation.
If you want help drawing these lines for your own paperwork, that is what my AI implementation consultation covers; the contact page is the way in.
Data questions contractors ask about ChatGPT
Is a Temporary Chat safe for confidential material?
It is safer, not safe. OpenAI says temporary chats are not used to improve its models and may be kept for up to 30 days for safety purposes. Redaction still applies, because the text leaves your control the moment you send it.
Does switching off model training make everything safe to paste?
No. It stops your chats helping to train models on personal plans, but the text is still stored on a third party's systems and visible to anyone with access to the account. The never-paste list stays off limits whatever the setting.
Are business plans safer than personal ones?
They offer more control, and OpenAI says business content is not used for training by default, plus admin settings for the workspace. Read the current terms and your client's contract before you decide, because a client may restrict AI use whatever plan you hold.
Can I paste a client's contract to have it summarised?
Only if the contract permits it and you have redacted names, prices and addresses. Many contracts contain confidentiality clauses that cover exactly this. If in doubt, ask the client or keep the document out.
What about photos from site?
Photos can show faces, vehicle plates, security cameras, alarm panels and street signs. Crop or blur these before uploading, and leave out any photo that shows how the site is secured.
Further reads
- How to Redact Personal Data From Documents With AI Before Sharing — Redaction methods that survive a second look.
- ChatGPT Plus vs ChatGPT Business: Which Plan Does a Team Need? — Whether your firm needs Plus seats or a Business workspace.
- Is ChatGPT Safe for Business Use? Risks, Settings and Plan Choice — Risks, settings and plan choice in one place.
- Construction Photo Documentation App: What AI Adds, and Which Plan — Photo apps with their own storage and sharing terms.
- AI Receptionist for Construction Companies: Real Costs and Call Routing — A call-handling tool that stores caller data.
- CIS Deduction Statement Template: Fill It From Your Payment Sheet With AI — The fields, the 14-day deadline and a payment-sheet method for a CIS deduction statement per subcontractor each month, with AI doing the checking.
- AI Tools and AI Development: The Complete 2026 Guide — the AI hub, including every tutorial in the AI-for-business series.
Sources: OpenAI help centre page Data controls in ChatGPT; OpenAI business data privacy and pricing pages (October 2026); illustrative figures from a hypothetical contractor.