Using AI Without Putting Customer Data at Risk: A Checklist for Trades Owners

A trades business holds more personal information than most owners realize: names, phone numbers, home addresses, photos inside people's houses, gate codes, when they are away, and sometimes payment details. When you add AI tools, that information can end up in places you did not intend. This AI customer data privacy checklist for trades owners is not legal advice, and it is not a substitute for talking to your attorney. It is a practical starting point.

It builds on the broader responsible AI use checklist for small businesses and on the series opener, our practical guide to AI for plumbers, electricians, and HVAC companies.

What Should You Never Paste Into a Chatbot?

Set a simple rule for your office. As a default, do not paste any of the following into a general-purpose AI assistant unless you have confirmed the tool, the account type, and the settings are appropriate:

• Full customer names with addresses and phone numbers together
• Gate codes, alarm codes, lockbox codes, and key locations
• Payment card numbers, bank details, or Social Security numbers
• Photos that show faces, documents, or identifiable interiors without permission
• Employee records, applicant details, or anything from payroll
• Anything a customer told you in confidence

The easy fix is to remove or swap out identifying details before using AI. Instead of pasting a real customer's email, paste it with the name and address replaced by placeholders, then add the real details back yourself.

Business Account or Personal Account?

This matters. Free personal accounts and paid business accounts often have different data handling and different settings, including whether conversations may be used to improve models. These terms change, so read the current terms and privacy settings of whichever tool you use, and do not assume. Where possible:

• Use a business account tied to a company email, not an employee's personal login
• Review the data and training settings and turn off anything you do not want
• Make sure the account belongs to the company, so access ends when an employee leaves

Who Has Access, and Can You Remove It?

Techs, office staff, and subcontractors do not all need access to everything. Give each person the minimum they need. Use individual logins rather than a shared password, turn on two-factor authentication where offered, and have a checklist for when someone leaves: remove their access to your field-service software, phone system, texting tools, and AI accounts the same day.

What About Call Recording?

Many AI phone tools record or transcribe calls. Recording rules vary and they are easy to get wrong. As a general overview, Oregon is often described as allowing one-party consent for phone calls, but requiring that everyone be notified for in-person conversations. Whether a specific setup complies depends on the details, so check with an attorney before recording. A few safe habits regardless of the legal answer:

• Tell callers up front if a call may be recorded or transcribed
• Decide how long recordings and transcripts are kept, and delete them on schedule
• Limit who can listen to them
• Do not record in-person conversations in a customer's home without clear notice and agreement, and check with your attorney first

If you run an AI answering layer, our post on what an AI receptionist can and cannot handle explains where the human handoff belongs.

What Should You Ask an AI Vendor?

Before you sign up for a tool that touches customer information, ask plain questions and get answers in writing:

1. Where is our data stored, and who at your company can see it?
2. Is our data used to train your models? Can we opt out?
3. How long do you keep our data, and what happens when we cancel?
4. Can we export and delete our data on request?
5. What happens if there is a security incident? How and when do you tell us?
6. Which other companies handle our data on your behalf?
7. What consent or opt-out features exist for texting and recording, and who is responsible for compliance?

If a vendor will not answer, that is an answer. For texting in particular, consent and registration rules like the TCPA and A2P 10DLC apply, and they are your responsibility to check. Our post on AI text messaging for service businesses goes through the basics.

How Do You Handle Photos and Job Content?

Job photos are great marketing, but they come from inside someone's home. Get permission before you publish a photo or describe a project. Leave out street addresses, house numbers, faces, and anything that makes a home easy to identify. See turning technician job photos and notes into marketing for a workflow that builds permission in.

Write It Down for Your Team

A one-page policy beats good intentions. Cover: which AI tools are approved, what may and may not be pasted into them, who owns the accounts, how recordings are handled, and who to ask if you are unsure. Review it every six months, because the tools and the terms will change. Pair it with the habits in seven AI mistakes home service businesses make, which flags what goes wrong when no rule exists.

A Short Checklist to Start With

• Written rule on what never goes into a chatbot
• Business accounts, with training and data settings reviewed
• Individual logins, two-factor authentication, same-day offboarding
• Recording notice and retention decided, and reviewed by your attorney
• Vendor questions asked and answered in writing
• Photo permission process in place

None of this makes a system risk-free. It makes you far less likely to be surprised.

Want an AI setup with these guardrails built in? See our plumbers, electricians, or HVAC lead system pages, or contact us.

Related Reading

• AI Risks for Small Business: A Responsible Use Checklist
• Seven AI Mistakes Home Service Businesses Make (and How to Avoid Them)
• ChatGPT for the Trades Office: Prompts That Save Real Time