Pasting a rental contract, electricity bill or lab report into a chatbot is tempting: it decodes the jargon in seconds. The catch is everything that travels with the document. Spain’s Agencia Española de Protección de Datos (AEPD) captured the risk in its January 2026 decalogue: “Be careful what you entrust to it.”
- Strip identifiers first: AI can explain confusing clauses or figures, but names, addresses, ID numbers, account details and medical data should be removed.
- “Temporary” is not “deleted”: ChatGPT and Gemini reduce persistence, yet both retain some data for limited periods.
- Local models are safest: Ollama and LM Studio keep documents on your disk, though compact models are less capable than cloud systems.
Step 1: Decide whether the document needs to leave your device
Before copying, ask what happens if that text reaches someone else. The AEPD asks users not to upload full name, address, phone number, DNI/NIE or a photo, and to avoid “especially” sensitive information: medical, financial or contractual details.
The warning is not theoretical. Google says in its Gemini privacy center that “a subset of chats” is reviewed by people, that reviewed conversations are kept “up to three years” even if you delete your activity, and it asks users:
“Do not enter confidential information that you would not want a reviewer to see.”
For work documents, follow your organization’s policies and exclude company contracts, reports, strategies, staff data and client data. The AEPD’s internal January 2026 summary requires its staff to “never enter private data, non-public information or personal data” into these tools.
Step 2: Remove identifying details—and other people’s data
Delete what says who; keep what says what.
For a contract, replace names with “Party A” and “Party B”; remove ID numbers, addresses, account numbers and signatures; paste only the clauses you do not understand. For a bill, strip the supply point code or contract number, service address and IBAN, while keeping concepts, amounts and rates. For a lab report, delete name, record number, center and requesting doctor; copy only parameters, values and reference ranges; do not paste a photo, because it carries letterhead, barcodes and sometimes your name.
If the document mentions other people—a guarantor, relative or child—remove anything that could identify them. When describing your situation, “describe a fictitious case”: “a 45-year-old person with these values” works as well as your full name.
The AEPD also notes that cookies, IP addresses, usage data, device and location information travel with the text, and that your questions, taken together, can “define” you by drawing a profile of what worries you. It suggests separate accounts and frequent history deletion.
Step 3: Choose the least persistent chat mode
Most assistants offer temporary modes and settings to keep conversations out of training. These reduce the trail; they do not erase it. As of October 2026, the promises differ.
ChatGPT: temporary chats do not appear in history, create memories or train models, but OpenAI “may retain a copy for up to 30 days” for security. Gemini: temporary chats and chats made with activity disabled are stored with your account for 72 hours. Disabling activity prevents future chats from being reviewed to improve services or used for training unless you send feedback; Google may still review them, including by people, to protect the service and its users.
The practical conclusion: these modes limit the trace, not eliminate it. What you do not upload remains the only thing that cannot leak.
Local AI and the limits of trust
To keep everything on your computer, run a model locally. With Ollama or LM Studio, the document never leaves your disk. The trade-off is hardware and capability: laptop models are weaker than cloud systems. They are usually enough to explain a clause or an out-of-range cholesterol value; they are probably not enough to cross-reference a 40-page contract against current regulations.
Trust the output for understanding, not deciding. The AEPD’s sixth tip says that if you need professional advice, go to a professional before AI, because it “may appear to understand what you describe, but it does not understand it” and “cannot offer qualified advice or a certain professional diagnosis.” Its seventh tip adds that answers may seem convincing “even though they may be wrong,” and verifying them is your responsibility.
Ask AI for plain-language explanations and questions, then take them to a doctor, lawyer or utility provider. Example: “Explain in simple language what each of these clauses means and tell me five questions I should ask a lawyer before signing.”
TechNews DevTop’s assessment: the real risk is not using AI to read documents—one of its most useful applications—but the laziness of pasting the whole PDF. Removing identifiers takes two minutes and turns a sensitive document into anonymous text. If the answer reassures or alarms you, call someone who signs their opinion with their name.