Name the data you should never paste or upload, on any account.
Sort anything you want to paste into an AI assistant into one of two groups first. One group never goes in, whatever the account and whatever the reason. The other can go in once you have taken out the parts that identify you or reveal your finances.
Priya, whose budget you followed through module 2, ran into both groups one evening while scrolling back through an AI chat history to find a prompt written in March (the dates and times in Priya's story are example figures). On the way, Priya came across a conversation from last year in which a whole bank statement had gone in, just to ask about a fee. It carried Priya's full name, address, account number and three months of balances. Further down sat a chat with a photo of a payslip, uploaded to ask about CPF deductions, with the NRIC number plainly readable. Nothing bad had come of either. Still, Priya had no idea where those files now were, who could see them, or how long they would be kept.
Some data works as a key to your accounts. That is the never list, and it includes:
passwords and PINs, for anything one-time passwords and verification codes, sent by SMS, by app or by email your Singpass ID, your Singpass password, and any Singpass verification step your full card number, card security code and expiry date together answers to security questions, for example your mother's maiden name or your first school
You will not meet a legitimate money task where an assistant needs any of these. The tasks in this course all run without them, including the budget from module 2 and the loan sheet from module 5. When you notice a never-list item about to go into a chat, stop, and ask yourself what you are really trying to get done.
Scammers want exactly this data. If a message tells you to paste banking details, a one-time password or your Singpass login into a chat, a form, an app or a "verification assistant", it is a scam. The name it uses and how official it looks make no difference. Chatbots on fake bank websites and fake customer service accounts on messaging apps fall into the same group. No real bank or government agency will ask you to type a one-time password into a chat. For how these scams run, see lesson 1.3 of the course "Scam-proof your money", "The stop-and-check rule for money, codes and apps".
The avoid list holds data that cannot open an account but does identify you or show what money you have. Keep it out of an assistant in its original form. On this list are your NRIC or FIN number; full account numbers for a bank, card, CPF or policy; complete statements carrying your name, address and balances; payslips with your employee number, NRIC or bank details; and tax notices with your tax reference number.
Where never-list items have no safe form at all, most jobs involving avoid-list data can be done with a cleaned copy. Take the transactions and leave the statement header behind. Quote the policy clause without the policy number. Give the deductions from a payslip and drop the NRIC. You already did this kind of redaction with your bank export in module 2, and lesson 7.2, "Redact first, and check your settings", walks through making redacted versions of each type.
A parent's insurance policy, a partner's payslip and a sibling's loan statement go on the avoid list as well. Those people never decided to hand their information to an AI provider. If you are helping someone in the family with money, get their agreement first, then redact their details with the same care you give your own.
If you handle client data at work, as financial advisers and their assistants do, you must also follow your employer's rules and the PDPA (Personal Data Protection Act), the law setting out how organisations in Singapore may collect, use and share personal data. Putting a client's details into your personal AI account is one of the things those rules are written to prevent.
Before any paste, run three checks. If the item is on the never list, stop. If it is on the avoid list, paste the redacted version. If it belongs to someone else, ask that person first.
Whatever you paste or upload joins your chat history with that provider. The provider holds the history on its own systems, tied to your account, for whatever period its policy sets. When you delete a chat, it disappears from your screen. Whether it also leaves the provider's systems, and how quickly, depends on the provider and on its privacy policy at the time. Some providers hold on to deleted content for a while for safety or legal reasons, and some may train future models on your conversations unless you switch that setting off.
All of this varies from one provider to the next and changes over time. Go to the current policy of the assistant you use and read it yourself. Do not take anyone's word for what it says, an assistant's included. Because uploaded data can outlast your choice to remove it, the two lists do the most good before you paste. Once something is in, they can only show you what to delete.
Priya went back through the history and deleted every conversation with data from either list. That meant the full statement, the payslip photo, and one more chat where the CPF account balance and NRIC had been typed in to ask about a housing loan. It took about fifteen minutes. Priya then wrote down which provider was holding the history and read that provider's policy on deleted chats.
The method has four moves. First, open the assistant and go back through your history with both lists in front of you. Second, delete each conversation that holds anything from either list. Third, make a note of the provider that keeps the history. Fourth, read that provider's current policy on deleted chats.
Start now: open the assistant you use most and scroll back through your own history with the two lists beside you.
Open the assistant you use most, go through your chat history, and delete every conversation that holds data from the never or avoid lists.
Junxiong-WFG Organisation is an authorised representative of AIA Financial Advisers Private Limited (Reg. No. 201715016G).