How we keep your data safe with AI
AI makes content work faster. It also creates a new question for every client: where does our data go? Here's the straight answer.
The short version
- We use business-grade AI accounts, not personal ones.
- Your data isn't used to train AI models.
- AI agents get the minimum access they need, and nothing more.
- Nothing is published or sent without a person approving it.
- When the work ends, we delete your data within 30 days, unless you ask us to keep it.
Which tools, which accounts
We work mainly with Claude, alongside ChatGPT, Microsoft Copilot and Google Gemini where clients already use them.
- Client work runs on business or team plans. On these plans, the major providers don't train their models on your content by default.
- Model training is switched off on any account where it's a setting. Consumer AI plans often train on conversations unless you turn it off, so we check.
- We recheck provider terms every quarter. AI companies change their data policies, so we don't assume last year's answer still holds.
- If you already have an approved AI tool, we use yours. Your data then stays inside your own governance.
What we never put into AI
- Passwords, API keys or access credentials
- Customers' personal data, unless you've approved it and there's a lawful basis
- Financial account details
- Anything marked confidential that you haven't cleared for AI use
- Unpublished financial results or market-sensitive information
If we're unsure, we ask first.
What AI agents can and can't touch
We build workflows that connect AI to tools like email, Drive, SharePoint and content systems.
- Least privilege. An agent gets access to the folders and tools a task needs. Never your whole drive nor your whole inbox.
- Read-only by default. Write access is granted per task, with your agreement.
- No unattended sending or publishing. Agents draft, people approve.
- You can see and revoke access. Every connection is listed in a handover document, and you can switch any of it off yourself.
- We watch for prompt injection. Text inside a document or email can try to give an AI instructions. Our workflows treat content as data, never as commands, and keep a human check before anything leaves the building.
There's always a person in the loop
AI does the research, drafting and checking. A person makes the editorial decisions and signs off every output. Nothing goes to your audience without human approval.
UK GDPR and your contract
- We act as your data processor and are happy to sign your data processing agreement, or provide ours.
- We can tell you which AI providers process your data and where.
- We keep a record of what data each workflow touches.
If something goes wrong
If we suspect your data has been exposed, we tell you within 24 hours, explain what happened, and help you meet your own reporting duties.
Training clients
For Margate AI workshops and one-to-one coaching:
- We set up tools on your own machines and accounts, not ours.
- We show you how to switch off model training and check your privacy settings.
- You leave with a one-page "safe AI" checklist for your team.
Questions buyers ask
Will our content end up training someone's AI?
No. Business plans don't train on your data by default, and we switch training off where it's a setting.
Can we use our own AI tools instead?
Yes. We'll work inside your environment and your policies.
Who can see our data?
Peter Springett, and the AI providers that process it under their business terms. No subcontractors without your written agreement.