TL;DR ChatGPT is generally safe to use for builder admin if you change one setting and redact personal details before pasting. The Privacy Act 1988 only legally applies to businesses with turnover over $3 million — but even if it doesn't apply to you, your clients still expect their information handled carefully. Here's the practical workflow — settings, what to redact, what's safe to paste.

Published March 2026 · Updated April 2026 · Reading time: 7 minutes · Written by Ryan Ramsay, founder of BuildBrief

Why I'm writing this

Every builder I've spoken to about AI eventually asks the same thing: "Is it safe to put my clients' details in there?"

Fair question. Nobody's writing it up plainly for trade businesses. The privacy lawyers write 9,000-word PDFs. The AI companies write reassuring marketing pages. Builders just want to know: can I paste this email or not?

Short answer: with the right setting toggled and a quick habit of redacting names, yes. Long answer below.

I'm not a lawyer. This isn't legal advice. It's the practical workflow I use and would recommend to any builder reading this.

What ChatGPT actually does with what you type

When you type something into ChatGPT, it goes to OpenAI's servers in the United States, the AI generates a response, and the response comes back. That's the basic transaction.

The thing builders worry about is what happens to the input after that. Three things to know:

1. On the free plan, by default, OpenAI may use your conversations to train future models. That means the words you type might — eventually, somewhere — influence what ChatGPT says to someone else. Not directly. Not "your client's name appears in someone else's chat." But the data goes into the training pool unless you turn it off.

2. There's a setting that turns this off. Two clicks. I'll show you below.

3. ChatGPT Plus and Team plans (~$30/month and up AUD) have stronger defaults. On a Team or Enterprise plan, training is off by default. On Plus, you still need to check.

The one setting you should change today

Whether you're on free or Plus, do this once and forget about it:

  1. Go to chatgpt.com and log in
  2. Click your initials top-right
  3. Settings → Data Controls
  4. Turn off "Improve the model for everyone"

Done. From now on, your conversations aren't used to train future models. They're still processed (the AI has to read your input to respond) but they're not retained for training.

If you're on Plus and you want extra caution, also use Temporary Chat for anything sensitive. Click the New Chat button at the top, then click "Temporary." Those chats aren't saved to your history at all.

What's safe to paste, and what to redact

Here's the rule I use. If your client would be uncomfortable knowing this exact bit of text was sent to an American tech company, redact it.

That sounds extreme. It's not. It's the same rule lawyers and accountants apply.

Safe to paste as-is:

Redact before pasting:

Always redact:

A practical example

Here's a real client email I might want ChatGPT to summarise. The before:

"Hi Ryan, just to confirm — the deposit of $14,500 has been transferred from our offset account to your Bendigo Bank account ending 4471 yesterday afternoon. We're heading to Sarah's mum's funeral in Hobart on the 14th, so could we push the start date to the 22nd? Also, our neighbour at 47 Camberwell Road has been making noises about the boundary fence, she's quite difficult, please let me know if you have any issues with her on site. Thanks, Mike Henderson, 0419 332 187."

The after, ready to paste:

"Client confirmed deposit transferred. Family bereavement means start date pushed from [original] to [new]. Neighbour at adjacent property may be difficult on site. How should I reply?"

Same context, none of the personal data. The output will be just as good.

Does the Privacy Act 1988 apply to me?

The Privacy Act 1988 (Cth) applies to Australian organisations with annual turnover over $3 million. There are also some specific cases regardless of turnover — health service providers, businesses that trade in personal information, contractors to the federal government, and a few others.

For most residential builders, you're below the turnover threshold. The Act doesn't strictly apply.

But here's the thing. Your clients don't know that. And the moment a homeowner finds out their personal details, financial situation, or property address ended up training an American AI model, you've lost the relationship — even if you were technically within the law.

Treat client data like you'd treat their bank details. Conservative, careful, redacted by default.

What to tell your subbies and admin

If you've got a bookkeeper, a sub-contractor, or an admin assistant who's also using AI tools — they need the same rules. Three things to brief them on:

  1. Settings: Turn off model training. Use Temporary Chat for sensitive work.
  2. Redact before pasting: Client names, addresses, phone numbers, financials.
  3. No client communication unless you've reviewed it: If they're using AI to draft client emails, those drafts come to you for review before they go out.

Write that into a one-page policy. Send it to anyone who works with you. Done.

Tools that handle this for you

If all of this feels like too much fiddling, that's fair. The alternative is using AI tools that are built for business use from the ground up:

BuildBrief is built so you don't have to think about any of this. The homeowner fills in a structured brief, the data lives in your account, the AI processes it under controlled conditions. Join the waitlist →

What to actually worry about

Of the things that could go wrong with AI in your business, AI training on your data is well down the list. The bigger risks are:

Privacy is real but solvable. The setting change above plus the redaction habit takes 30 seconds and you're 95% of the way there.

FAQ

Is ChatGPT secure? Yes — it uses bank-grade encryption between you and OpenAI's servers. The privacy concern is what they do with the data after, not whether it can be intercepted. The data-controls setting fixes that.

Should I be worried about the data going overseas? The Privacy Act is principally concerned with how data is handled, not where. As long as it's protected to Australian standards, the location is secondary. Big enterprises have specific cross-border requirements; small builders generally don't.

What about Google Gemini and Microsoft Copilot? Same principle. Each has its own data-controls settings. Free tiers may use your data for training; business tiers don't. Check the settings page.

Can I use AI to draft a contract? You can use it to draft. A solicitor or qualified contracts admin must review before signing. AI gets things wrong on contracts more than any other document type.

My CRM has AI now — should I use that or ChatGPT? If your CRM is built for builders and processes client data with proper controls (like BuildBrief, Buildxact, ServiceM8, Tradify), use that for client-data-heavy tasks. Use ChatGPT for the generic stuff — emails, drafts, summaries with redacted inputs.

What if I've already pasted client info into ChatGPT? Don't panic. Go to Settings → Data Controls and you can delete your conversation history. Then turn off model training going forward.

Where to go from here

Two things to do today:

  1. Turn off model training. Settings → Data Controls. Two clicks.
  2. Save the redaction list above as a sticky note or note in your phone. Use placeholders for names, addresses, and contract sums.

That's it. You're now using AI more carefully than 90% of small businesses in Australia.

Once you're confident handling client data safely, the practical guides on what to actually do with AI are:

If you'd rather use a tool where the privacy is handled for you — homeowner data captured under Australian-grade controls, structured briefs in a dashboard, no copy-pasting — that's BuildBrief. Join the waitlist.

About the author

I'm Ryan Ramsay, founder of BuildBrief. I write practical, Australian-specific guides for residential builders learning to use AI in their business. The BuildBrief AI Tips and Tricks blog publishes a new piece every fortnight.

Disclaimer: I'm not a lawyer. This article is general information, not legal advice. If you have a specific privacy or compliance question, talk to a solicitor or contact the Office of the Australian Information Commissioner (oaic.gov.au).

Question? Email hello@wolfari.com.au.