Privacy and data controls

0:00 Privacy and data controls

Every file you paste into an AI tool is a decision about someone's data, often your client's or your customers'. The good news is that protecting it is mostly about a few settings and a few habits. In this lecture you will learn how Claude handles data on different account types, run a ten minute privacy check up, and learn a classification system that makes safe choices automatic.

0:30 Why privacy is practical

Why focus on privacy? Because most data leaks in AI use are not dramatic hacks. They are habits. Pasting a whole customer export when three columns would do. Using a personal account for client work, just this once. Forgetting a share link that is still live. Think of it like locking your front door. The lock is the setting, and the habit is remembering to use it. This lecture gives you both, so you can use Claude with real work confidently.

1:05 Consumer vs commercial

Anthropic treats consumer accounts, meaning Free, Pro and Max, differently from commercial offerings like Team, Enterprise and the API. On consumer plans, you choose in your privacy settings whether chats and coding sessions can be used to improve Anthropic's models, and the policy describes different retention periods depending on that choice. Under commercial terms, customer content is not used for training by default, and organisations can agree extra controls like custom retention. Policies do change, so read the current versions before you tell a client how their data is handled.

1:44 The 10-minute check-up

Now the check up. Set your model training preference deliberately. Delete chats you no longer need, and export your data if you want a copy. Review your memory entries and the sensitive topics setting. Learn how to start an incognito chat. Disconnect connectors and skills you are not using. Revoke shared links and published artifacts you no longer want public. And remove anything confidential from your profile preferences. Put a quarterly reminder in your calendar to repeat it.

2:18 Four data classes

Classify before you share. Public data, like published posts, can go into any approved tool. Internal data, like plans and drafts, goes into your approved work account. Confidential data, like client contracts, unreleased campaigns and pricing, goes only into an approved commercial workspace, and only as much as needed. And restricted data, meaning passwords, API keys, payment card data, government IDs, health data and other special categories, never goes into general AI chats at all.

2:51 Minimise, anonymise, aggregate, excerpt

Four habits reduce risk dramatically. Minimise, by sharing the clause, not the whole contract, and the three columns you need, not the full CRM export. Anonymise, by replacing names and emails with IDs like customer zero fourteen. Aggregate, by saying forty two complaints about delivery in March rather than listing forty two named complaints. And excerpt, by pasting the relevant section with context instead of uploading every attachment.

3:21 Law and contracts

Data protection law applies to personal data you process with AI. In the UK, UK GDPR and the Data Protection Act. In Europe, the GDPR. In the UAE, the federal personal data protection law, plus separate rules in the DIFC and ADGM free zones. In Saudi Arabia, the Personal Data Protection Law. And Pakistan's framework is evolving. Client contracts often go further, sometimes banning third party AI processing altogether. Involve your data protection lead and read the contract before using client data in any AI tool.

3:58 Simple example

A simple example. You want Claude to spot patterns in five customer complaints. The raw text includes names, emails and order numbers. Before pasting, replace each name with a label like customer zero fourteen, delete the emails, and keep the order numbers only if you truly need them. Ask the same question. The analysis is just as useful, because the insight was in the complaint text, not the identities. It takes two minutes, and it removes the personal data from the equation entirely.

4:34 Worked example: 2,000 survey responses

A marketing assistant at a Dubai retailer needs themes from two thousand open text survey responses. She exports only the response text and a customer segment column, strips names, emails and order numbers, and uses the company's Claude Team workspace rather than her personal account. She asks for themes with example quotes containing no identifiers, documents her method for her manager, and deletes the working file from her downloads afterwards. That is privacy by habit. Later that quarter, a customer asked the retailer whether their survey answer had been fed into an AI system. Because the method was documented, the team could say exactly what was used, anonymous response text only, in the company's Team workspace, with no names or emails. A clear process turned a potentially awkward question into a reassuring answer.

5:32 For API builders

If you build on the API, the same principles become design choices. Send only the fields each call needs. Strip identifiers wherever possible. Keep keys on the server. Log without personal data. And check the data residency and retention options that apply to your use, then record them in your records of processing, so you can answer an auditor or a client in one sentence.

6:00 Try this now

Try this now. Open your Claude settings and work through the check up. Decide your model training preference. Delete chats you no longer need. Review memory and the sensitive topics setting. Find where incognito starts. Disconnect unused connectors and skills. Revoke old share links. Remove anything confidential from your profile. Then write one paragraph, my AI data policy, listing which of the four data classes you will put into which tools. Share it with your manager or data protection lead, and set a calendar reminder to repeat the check up every quarter.

6:40 Watch me do it, part 1

Let me do the check up on screen. First, privacy settings. I read the model training preference and set it deliberately. Next, chat history. I search for a client we finished working with and delete two old chats. Then memory. I scan the entries and check the sensitive topics setting. Connectors next, where I find an old project management tool still connected, and I disconnect it. Finally, shared links. There is a link to an artifact I shared with a freelancer last year, still live, and I revoke it. Five screens, about eight minutes, and I know my account is clean.

7:24 Watch me do it, part 2

Now the survey example. I open the export of two thousand responses. I delete the name, email and order number columns, and keep only the response text and the customer segment. I switch to the company's Claude Team workspace, and I can see the workspace badge, so I know commercial terms apply. I upload the trimmed file and ask for the top themes with counts and two short quotes each, containing no personal details. The themes come back, and I spot check three quotes against the file. Then I write a three line method note for my manager and delete the working file from my downloads.

8:10 Recap and next step

Recap. Consumer and commercial accounts handle data differently, so know which one you are using and read the current policy. Run the privacy check up every quarter. Classify data into four classes, never share restricted data, and minimise, anonymise, aggregate and excerpt everything else. Check the law and your contracts first. Your next step: run the check up today and write a one paragraph personal data policy for your own AI use.