Skip to content

For the trades

Using ChatGPT for quotes and emails.
What never goes in.

Half the trades I talk to are already doing this: a job description into ChatGPT, out comes a tidy quote or a polite chasing email. Good — it saves an evening a week. But the customer’s name, their address and the key-safe code went in with it, and that is where a useful habit becomes a data leak. Here’s the line, in plain English.

Using ChatGPT or any AI tool to draft quotes and customer emails is fine. The risk is what you paste in: a customer’s name with their address, phone numbers, key-safe or alarm codes, photos of the inside of their home, or anything about their health. Keep those out, use a business account with training switched off, add one line to your privacy notice, and you’re compliant.

Mick Stevenson Forty years across trades, construction, property and plant hire before software. RPII-registered Operational Inspector. Builds and secures AI tools for Cornish trades.

Published

On this page

  1. 01 What is fine to paste in
  2. 02 What never goes in
  3. 03 Why it matters: where the words go
  4. 04 The account you’re on is the whole game
  5. 05 The ten-minute fix
  6. 06 A prompt that does the job without the data

What is fine to paste in

The job, without the person. An AI tool writes a better quote when it knows what the work is, not who it’s for. All of this is fine in any tool, on any plan:

  • The scope: “strip and re-slate a 60m² pitched roof, replace two lead valleys, new breathable membrane”
  • Your own rates, materials and lead times
  • The type of property and the area: “1930s semi in Truro”, “holiday let near Padstow”
  • Your terms: deposit, payment stages, guarantee, what’s excluded
  • The tone you want: “polite but firm, this is the second reminder”

Notice there’s no name in there. You add “Dear Mrs Pascoe” and the address yourself, after the tool has done the writing. That one habit removes most of the risk on its own.

What never goes in

Not on a free plan, not on a paid plan, not on a business plan. These don’t belong in a general AI tool at all, because the tool doesn’t need them to do the job and the downside if they leak is serious.

Access codes with an address

Key-safe, alarm, gate and garage codes. “Key safe 1472, side gate” next to a postcode is a burglary in one message. Keep these in your job system, not in a chat window.

Name + address + phone together

Each on its own is personal data. All three together is a complete record of a real person. The tool doesn’t need any of them to write the quote.

Anything about someone’s health or circumstances

“Elderly, lives alone, hard of hearing, leave the door on the latch.” Health details are special-category data under UK GDPR — the highest bar there is — and that sentence is also a safety risk to the customer.

Photos of people or the inside of homes

A boiler is fine. A kitchen with post on the worktop, a child’s school jumper on the chair and the street through the window is not. Crop to the work. No faces, ever.

Tenants’ and landlords’ details

On a landlord job you hold data about two people, and the tenant never agreed to anything. Their name and number stay out.

Bank details and card numbers

Yours or theirs. If an invoice template needs your bank details, add them after the tool has written it.

Why it matters: where the words go

When you type into one of these tools, the text leaves your phone and goes to the company’s servers — usually in the United States — to be processed. What happens next depends on the plan you’re on. On a consumer plan the company may keep your conversations and, unless you’ve turned it off, use them to improve its models. On a business plan it doesn’t train on them, and keeps them only as long as it says in its terms.

That’s the whole data-protection question in two sentences. UK GDPR doesn’t ban AI tools. It asks whether you had a lawful reason to process the customer’s data, whether you told them you were doing it, and whether you handed it to someone who might do something with it you never agreed to. A customer’s address in a model’s training data is the third one.

The ICO — the regulator — doesn’t go looking for one-man bands who used the wrong plan. It acts on complaints and breaches. The realistic risk for a small firm isn’t a fine; it’s a customer finding out that their access code went into a free chatbot, telling the village, and leaving a review that says so.

The account you’re on is the whole game

Every one of these tools comes in two kinds of account, and the names are confusing on purpose.

Kind of account Examples Your data
Consumer ChatGPT Free, Plus, Pro · Claude Free, Pro, Max · Gemini personal · Copilot personal May be used to improve the model unless you find the setting and turn it off. Conversations kept.
Business ChatGPT Business or Enterprise · Claude Team or Enterprise · Gemini in Workspace · Microsoft 365 Copilot Not used for training by default. Covered by a business agreement you can point to in your privacy notice.

A business plan for one or two people costs about the same as a round of bacon rolls each month. If anyone at the firm puts customer details into an AI tool, that is the plan they should be on. If you want to stay on a consumer plan, go into the settings today and turn off “improve the model” — and then keep all the personal data out anyway, because the retention still applies.

The ten-minute fix

  1. 01

    Find out what the office is actually using. Ask, don’t accuse. Most people have never thought about it.

  2. 02

    Put it on a business plan, or at minimum turn off model training on the consumer one.

  3. 03

    Agree the rule: the job goes in, the person doesn’t. Name, address, phone, codes, health, photos of people — added afterwards, by hand.

  4. 04

    Add one line to your privacy notice. “We use AI tools to help draft quotes and correspondence; customer details are processed under a business agreement and are not used to train AI models.”

  5. 05

    Write it down. The one-page staff AI policy is free and takes ten minutes to fill in. It’s what you point to if anyone ever asks.

A prompt that does the job without the data

Copy this, change the details, paste it into whichever tool you use. Nothing in it identifies the customer.

Write a quote for a roofing job. I am a roofer in Cornwall.

Job: strip and re-slate the front elevation of a 1930s semi, approx 45m², reclaimed Delabole slate to match the rear, new breathable membrane, replace one lead valley, re-bed ridge tiles.
Price: £[your figure] plus VAT, materials and scaffold included, skip excluded.
Lead time: 5–6 weeks from deposit.
Terms: 25% deposit, balance on completion, 10-year workmanship guarantee.
Tone: friendly, professional, short. Leave a gap for the customer's name and address, which I'll add myself.

The tool writes the quote. You add the name and the address. The customer gets a professional document, and nothing about them ever left your phone.

Where this comes from

This is plain-English guidance for small businesses, not formal legal advice. Where something genuinely needs a solicitor or a data-protection specialist, I'll tell you straight.

Straight answers

Is it illegal for a tradesperson to use ChatGPT for quotes?
No. Using an AI tool to help write a quote or an email is fine. What UK GDPR cares about is the personal data you paste in to do it — a customer’s name, address, phone number — and whether the tool you’re using may keep it or learn from it. Fix those two things and the drafting itself is nobody’s business but yours.
Does this apply to Claude, Copilot and Gemini as well?
Yes, all of them. The names differ, the rule is the same: a consumer account may use what you type to improve the model unless you turn that off; a business account is excluded from training by default. Check which one you’re on — it is the single most important setting.
I pay for ChatGPT Plus. Doesn’t that cover it?
No. Plus and Pro are consumer plans — paying more gets you better models and bigger limits, not different data handling. The line is consumer versus business, not free versus paid. The same is true of the paid consumer tiers of the other tools.
What’s the worst thing I could paste in?
A key-safe code, alarm code or gate code alongside an address. That is a burglary kit in one message, and it is the thing tradespeople are most likely to have in a note on their phone. Health details about a customer come a close second — “the lady is disabled and the key is under the mat” is special-category data and an access code in the same sentence.
What about photos of the job?
A photo of a boiler is a photo of a boiler. A photo of someone’s kitchen with their post on the side, their kids’ drawings on the fridge and a view of the street is personal data about identifiable people. Crop before you upload, and don’t upload photos with people in them at all.
Do I have to tell customers I use AI?
If their personal data goes into an AI tool, your privacy notice has to say so. One sentence does it: “We use AI tools to help draft quotes and correspondence; customer details are processed under a business agreement and not used to train AI models.” If you only ever paste in anonymised job details, there is nothing to declare.
My office person has been doing this for a year. Am I in trouble?
Probably not, and panicking won’t help. Find out which account was used, switch it to a business plan, turn off training if it was a consumer plan, add the line to your privacy notice, and write a one-page rule so it doesn’t carry on. Whether anything is reportable depends on what went in — access codes and health details are the ones to take seriously.

Read next

A one-page staff AI policy you can actually use

Free template. What staff may and may not put into AI tools, which tools are approved, who checks the output. Prevents most incidents before they happen.

Can I put customer information into ChatGPT?

The single most common way small firms leak data. When it is fine, when it breaches UK GDPR, and how to make it safe.

AI for tradespeople: what is worth your time

Written by someone who spent forty years on the tools. What genuinely helps a working trade, and what is sales patter.

Want it done properly in an afternoon?

Not sure which accounts your staff are actually on, or what the one-page rule for the office should say? Ask. Written for a trade, not a corporation, and I'll tell you what you can sort yourself.

Talk to Mick