Keep business data safer when you use Gemini

What you will be able to do

You will know what not to paste into Gemini, how a personal Gemini Apps account differs from Google Workspace at a high level, and which Google help pages to read—without treating this article as a compliance certificate.

The honest answer

Business data in Gemini is only as safe as:

• What staff paste or connect
• Whether they are on a personal Google Account or a Workspace account your admin controls
• What Google’s current terms say for that product
• What happens on a busy Friday

No chat box makes a careless paste safe.

Personal Gemini Apps (free and paid Google AI plans)

The Gemini Apps Privacy Hub covers Gemini on the web (gemini.google.com), the Gemini mobile app, and the related consumer surfaces it lists. It says Google uses the data it collects to provide, maintain, and improve services, and that those uses extend to the generative models behind Gemini Apps. Human reviewers look at some of that data. Google’s own notice says not to enter confidential information you would not want a reviewer to see or Google to use to improve its services.

Gemini Apps Activity, including the Keep Activity setting, is where you control whether your data is used to improve Google AI, including those models. Google also says that even if Keep Activity is off, chats are still used to answer you and to protect Google and users, including with human reviewers, and that your Gemini settings do not control anonymized processing used to improve Google services. Read that section yourself before you write a staff rule. Do not rely on a remembered “turn this toggle off and nothing is stored.”

If you connect Gmail, Drive, or other Google apps from a personal Gemini account, those lookups follow the same Gemini Apps Privacy Notice. Google’s help says Workspace connections are unavailable when Keep Activity is off. Connecting the shop inbox to someone’s personal Gemini login is a different decision from using Gemini inside Workspace. See Drive, Gmail, Docs, and Sheets.

Work or school Google Accounts are called out in that same privacy hub as a different set of terms.

Google Workspace

The Generative AI in Google Workspace Privacy Hub says, for Workspace customers using Gemini, that interactions stay in the organization, that your content is not used for other customers, and that your content is not human-reviewed or used to train generative models outside your domain without permission.

Google’s admin article on turning the Gemini app on or off says users on a qualifying Workspace edition are under the Workspace terms, and users without a qualifying edition fall under the consumer Gemini terms—and should not enter confidential information. Know which bucket each login is in.

Defaults can change. Re-read both hubs before you set shop policy.

What not to paste

Same postcard rule as customer data and AI tools:

• Card numbers, bank logins, passwords
• Full charts or health details the draft does not need
• Children’s data, government IDs, unrestricted HR files
• Gate codes and anything you would not put in a shared email

Prefer the role and the facts the draft needs. Remove names when the job does not need them.

For the Claude and ChatGPT versions of this question, see data in Claude and data in ChatGPT.

What this article is not

It is not a legal opinion, and it is not a statement that your practice is covered by any certification. Google’s Workspace privacy language describes Google’s product. It does not automatically cover your clinic, spa, or shop. Confirm the agreement you signed, and ask your own counsel if you handle regulated records.

Try this job: a one-page Gemini data rule

1. Red: never paste (the list above).
2. Yellow: allowed only in Workspace, with the admin’s approval, and only the fields the job needs.
3. Green: public pages, approved templates, anonymized examples.
4. Name who may use a personal Gemini login for work, and who must use the Workspace account.
5. Pin the page. Review it when Google updates the two privacy hubs.

Short close

Paste less, put real work on the Workspace account when the privacy hub is the one you meant, and read Google’s pages rather than a rumor.