AI in the trades, 29 October 2026
Is it safe to give AI your email, Xero and customer data? (UK GDPR)
It can be safe, and lawful under UK GDPR, if three things are in place: you use a business plan that doesn't train on your data, you have a written processing contract with the AI supplier, and you can see and approve what it does with your inbox and Xero. You stay responsible for your customers' data whichever tool you use.
What does UK GDPR say about using AI?
The same as for any other software that handles personal data. You need a lawful basis, you must tell people how you use their data, you should use only what you need, and you must keep it secure. The ICO's guidance on AI says procuring an AI system from a third party "does not absolve you of responsibility for complying with data protection law".
For a trade firm, personal data means customer names, addresses, phone numbers, photos of their homes, and the emails in your inbox. Your lawful basis for using it to quote and invoice is normally that you have a contract with them, or are about to. Using it to train someone else's AI model is a different purpose, which is why training settings matter.
The ICO adds that a data protection impact assessment is required where processing is likely to result in high risk to people. Connecting a quoting assistant to your inbox isn't usually high risk; large-scale processing of sensitive data would be. If you aren't sure, a short written assessment is good practice and costs nothing.
Do the AI companies train on your data?
It depends on the plan. Personal plans tend to allow training unless you opt out; business plans tend not to by default. As of October 2026, from each vendor's own pages:
| Tool and plan | Trains on your content by default? | How to control it |
|---|---|---|
| ChatGPT Free, Plus, Pro | May do | Turn off "Improve the model for everyone" in Settings, Data controls |
| ChatGPT Business, Enterprise, API | No | Off by default |
| Claude Free, Pro, Max | Your choice | Model improvement setting in Privacy settings; 5-year retention if on, 30 days if off |
| Claude Team, Enterprise, API | No | Off by default |
| Microsoft 365 Copilot Business | No | Microsoft says prompts and responses aren't used to train the underlying models |
One catch: OpenAI says that giving a thumbs up or down on a Free, Plus or Pro conversation can allow the whole conversation to be used for training, even after you've opted out.
What happens when you connect AI to email and Xero?
You give it access on your behalf. In Xero, an app connects with the permissions of the user who authorised it, and Xero says the connecting user must be a Standard, Adviser or Administrator user with the Connected Apps permission. Payroll access needs a payroll admin to authorise it. So connect with a user whose access matches what the tool needs, and review your connected apps when you stop using one.
Email is broader. An inbox holds customer addresses, bank details in supplier emails and sometimes health information, such as a client mentioning a disability when asking for a level-access shower. Ask the supplier which folders it reads, whether it can send without you approving, and how long it keeps copies.
Five of the 28 firms on our sales calls raised data safety, lock-in or vendor risk. A builder-developer in Hertfordshire running six projects asked "Is it open sourced, or is it closed?" and "How safe is all that?", and worried about price rises: "suddenly they start increasing up in price… I've lost everything I've built." Those are the right questions.
Is this AI setup safe enough? Quick check
Record what it does in your privacy notice and review connected apps every few months.
Switch off training on personal plans or move to a business plan before you paste customer details in.
Most business AI suppliers publish processor terms. Without one you can't show compliance with UK GDPR.
Request a list of sub-processors and where data is held. For US suppliers, check whether they're listed under the Data Privacy Framework.
Turn on approval steps or limit it to drafts. Mistakes sent automatically are hard to undo.
Ask how to get your data out before you depend on it.
What should you ask an AI supplier before connecting?
Ask for the paperwork, not the sales page. Each item below maps to something the ICO expects you to have or know.
What if something goes wrong?
Act fast. If a breach is likely to put people at risk, such as customer details sent to the wrong person or an account taken over, you must report it to the ICO within 72 hours of discovering it. The clock starts when you found it, not when it happened. If the risk to people is high, tell them as well, without undue delay. Breaches unlikely to cause harm may not need reporting; record what happened and why either way.
What about sending data to the US?
Most AI models run on US-based services, so check the route. Since 12 October 2023, UK businesses can send personal data to US organisations certified to the UK Extension to the EU-US Data Privacy Framework without extra safeguards. The government's factsheet says to check that the recipient is active on the DPF list and signed up to the UK Extension. If the supplier isn't on the list, the ICO says the transfer needs appropriate safeguards or an exception. Ask the supplier which route it relies on.
None of this needs a solicitor for a typical small firm. If you handle health data at scale, work for public bodies with their own data terms, or a client asks for a data protection audit, get advice from a data protection specialist.
Where Nexley fits
Nexley is the AI back office for UK trade firms: five AI assistants run your tenders, quotes, buying, scheduling and invoicing. It connects to the tools you already work in, you run it all from WhatsApp, and you approve everything. £799 a month.
Nexley connects to your inbox and Xero to draft quotes, file supplier bills and chase invoices, and every client-facing message or accounting entry waits for your approval on WhatsApp first. Ask us for our data processing terms, sub-processor list and export process before you connect anything; it's month-to-month, so you aren't locked in.
Common questions
Is it legal to paste customer details into ChatGPT?
It can be, if it's for a purpose your customer would expect, you've told them in your privacy notice, and your plan doesn't train on it or you've turned training off. Keep it to what's needed: a first name and job details usually do.
Do I need to tell customers I use AI?
Your privacy notice should say who you share their data with and why, which includes AI suppliers acting as your processors. A line naming the type of supplier and purpose is normally enough for a small firm.
Is Microsoft Copilot safer because I already use Outlook?
Microsoft says Copilot Business keeps prompts and responses within the Microsoft 365 service boundary and doesn't use them to train the underlying models. That's a strong position if you're already on Microsoft 365, but the checklist above still applies.
Can an AI tool see my bank details in Xero?
It sees what the authorising user's permissions allow. Connect with a user whose access fits the job and review connected apps regularly.
Sources
- ICO: How to use AI and personal data appropriately and lawfully
- ICO: What needs to be included in the contract?
- ICO: 72 hours, how to respond to a personal data breach
- ICO: How does the UK Extension to the EU-US Data Privacy Framework work?
- GOV.UK: UK-US data bridge, factsheet for UK organisations
- OpenAI Help: How your data is used to improve model performance
- OpenAI: Enterprise privacy
- Anthropic: Updates to consumer terms and privacy policy
- Microsoft: Microsoft 365 Copilot for business (UK)
- Xero Developer: Permissions FAQs
Every rule, rate and date above was checked against these sources on the date shown at the top.
Topic: AI in the trades
Keep reading
AI in the trades
ChatGPT or trade-specific AI? What each is good at for a building firm
An honest split of what a general AI chat tool does well for a small trade firm and where a tool built around your office takes over. With a side-by-side table, a monthly cost comparison and a quick check on which you need.
AI in the trades
Why ChatGPT gets your quotes wrong: hallucinations, old prices and no live data
Why an AI chat tool's price for a building job is a guess, what that guess costs on a real bathroom refit, and a five-minute test and checklist to run before any AI-drafted quote goes to a client.
AI in the trades
AI for tradesmen: 12 jobs it can take off you this week
Twelve pieces of office work AI can take off a small trade firm now, which ones a free AI chat tool handles and which need a connected tool, and what firms we spoke to saved. With an admin cost calculator for your own hours.
