Claude data privacy: the habits your marketing team needs

The question always comes at the same point in the workshop, toward the end of the morning, when the team starts finding the tool truly useful: “and our client files, can we put them in there?”

Claude, Anthropic's generative AI assistant, now runs in nearly every marketing team I work with. Most often without anyone having written a single line of rules.

I'm a trainer, and I leave the law to the lawyers. I summed up the essentials in 2 articles: what GDPR and the AI Act require when you plug AI into your customer data, and data privacy when you connect AI to your CRM.

Here, I describe your habits: what you paste, what you open, what you connect, and what you write down so it holds beyond the first month. Every fact about Claude links to the official Anthropic page that publishes it, reread on October 28, 2026.

Claude data privacy: what does your plan change?

Start there. The answer changes completely depending on the way in, and within a single team, several plans almost always coexist.

Sources, checked on October 28, 2026: training on individual accounts, retention on individual accounts, training on commercial products, retention of organization data and data processing addendum.

On an individual account, the model improvement setting is under Settings, then Privacy. Conversations in incognito mode never train the models, even with the setting on. And Claude Code used with a Pro or Max account follows the rules of that individual account.

The thumbs-up sends the conversation

Anthropic says it doesn't use the inputs and outputs of its commercial products to train its models by default. With one clear exception: if you submit feedback or report a bug, notably with the thumbs-up or thumbs-down button, the conversation can be kept for up to 5 years and used for training, after being disconnected from your user ID.

So never rate a response that contains client data.

The API and Claude for Work follow different retention rules

Anthropic's retention page, updated on July 1, 2026, separates 2 regimes that many people lump together. On the API, inputs and outputs are deleted automatically within 30 days of being received or generated. The API documentation goes further: by default, the API keeps no content from the exchanges, except for the Fable and Mythos models, which are kept for 30 days. On Claude for Work and Enterprise, conversations are kept so the product stays usable from one session to the next, and the 30-day clock starts only when someone deletes the conversation.

This nuance decides the answer you'll give in committee. The published exceptions: files managed through the Files API, custom agreements such as zero data retention, legal obligations, and up to 2 years in case of a usage policy violation (7 years for classification scores).

Storage stays in the United States

Anthropic says it routes customer traffic to selected countries in the United States, Europe, Asia and Australia, and adds that data is stored in the United States. On the API, the data residency documentation offers 2 inference options, global or US only, and storage in the United States. On Amazon Bedrock and on the Google-managed offer on Google Cloud, the processing region depends on the endpoint you choose with the cloud provider.

For the file your IT department will ask you for: Anthropic publishes its certifications, ISO 27001:2022, ISO/IEC 42001:2023, SOC 2 Type I and II, and a HIPAA-ready configuration. Reports can be requested on its trust portal.

So the first team habit is administrative, and it's tedious: listing who uses which plan. Almost every time, going around the table turns up a personal account that client documents pass through.

What you never paste into Claude

A list short enough to remember changes everyday habits. Mine has 5 lines.

• Technical secrets. Passwords, API keys, access tokens, the contents of a configuration file. A secret pasted into a chat is a secret to change, whatever the vendor's policy.
• Payment data. Card numbers and bank account details. No marketing use case needs them to work.
• Sensitive data under GDPR. Health, opinions, union membership, data about children. They call for a legal framework that goes well beyond a team policy, and on this point I refer you to my article on GDPR and the AI Act.
• Raw CRM exports. A 4,000-row file sent to analyze 3 segments is personal data shared for no reason.
• Anything covered by a confidentiality agreement. Client contracts and documents from a request for proposals in progress. Reread the contract before you open the conversation.

On an individual account, Anthropic excludes from model improvement the raw content pulled in by a connector, Google Drive or an MCP server. What you copy by hand into the conversation can be included.

So when the model improvement setting is on, the connector protects you better than copy and paste. It's counterintuitive, and it sticks in people's minds during sessions.

Finally, client work always runs on a commercial plan. Anthropic's data processing addendum covers Claude for Work and the API, while Free and Pro accounts fall under the consumer terms.

How do you prepare a client file before sending it?

The most cost-effective habit on the list takes 5 minutes, and it spares you the flat ban the team would work around by the following week.

1. Cut the columns the task doesn't need. A segment analysis only needs the industry and the company size: the contact details stay in the CRM.
2. Replace identities with codes. Client A, Client B. You keep the lookup table on your machine, and you put the real names back in the final deliverable.
3. Open the free-text columns. Sales comment fields are the systematic blind spot. That's where names hide, and sometimes opinions about people.
4. Reread the export before sending it. 30 seconds of reading catch what the filter let through.

To go beyond the manual habit, I detailed the automatic anonymization method with Presidio, Microsoft's open-source tool that detects and masks personal data entirely locally, on your computer.

A team that picks up this habit gains something else along the way: it starts thinking about what the task really needs. That's GDPR data minimization, achieved through a daily habit.

What scope should you give Claude on your computer?

This is the part that has changed most since the summer, and the one where I see the fewest written rules.

Since September 16, 2026, Chat and Cowork have been merging in the Claude app. If you still know Cowork by that name, the same conversation now answers a quick question or carries out a long task. The rollout started with Pro and Max. Team has it in beta, and Enterprise has had it since October 23.

In the desktop app, you give Claude access to a folder on your computer, and it can read and create files there. The folders you've opened are listed in Settings, under Trusted folders. Long tasks keep going in the cloud when you close your computer, and your local files and the built-in browser stay accessible as long as Claude Desktop is open. I listed 58 office use cases for Cowork in another article.

Anthropic itself recommends creating a dedicated working folder for Claude, and being careful with financial documents and credentials. It's my rule on client engagements too: one folder per client, and nothing above it.

The approval mode is your first security setting

The unified app offers 2 modes, chosen in the input box for the whole conversation. In Auto, the default on Pro, Max and Team, Claude moves forward without asking you at each step, and automatic safety checks run before each action. In Manual, the default on Enterprise, Claude asks for your approval before acting.

On a client account, I switch the team to Manual: Anthropic recommends manual approval whenever a task touches sensitive files or accounts. Cowork's safety page also describes a 3rd mode, which skips every approval with no checks at all. It's the only setting I ban in black and white in a usage policy.

For teams moving to Claude Code, the same logic is written in code: a hook blocks a destructive command before it runs.

The built-in browser arrived on August 26

Since August 26, 2026, Claude has had its own browser. It opens in a side panel next to the task, and it opens websites, reads pages, clicks, types and fills in forms while you watch. It works in the desktop app (Linux in beta) on Pro and Max, and on Team and Enterprise as long as an owner hasn't turned it off. From the web or mobile, Claude uses it as long as the desktop app stays open and connected.

This browser belongs to Claude, isolated from yours. Anthropic says it touches neither your tabs nor your credentials, and that Claude sees your saved credentials only if you choose to import them. Imports happen site by site, and banking, email and single sign-on sites stay unchecked by default.

What you sign into stays signed in. Claude keeps your logins from one session to the next, so you don't have to sign in again. At the end of an engagement, sign out of the client's tools the day you hand back your badge.

Sensitive data stays out. Anthropic strongly advises against using it for financial accounts or for other people's personal data, your clients' included.

The risk behind all of this

That risk is called prompt injection: malicious instructions slip into content Claude reads during a task, such as a web page or an email. An AI agent that takes them as instructions then acts on the attacker's behalf. In the routine that sorts my emails, the content of an email is treated as data, even when it addresses Claude.

The built-in browser blocks high-risk sites, and Claude asks for your permission the first time it acts on a site. By default, it also asks for your approval before permanently deleting a file.

Anthropic itself writes, in the browser announcement, that these measures reduce the risk without eliminating it, and recommends starting with trusted sites.

On Team and Enterprise, the organization owner decides whether the built-in browser and Claude in Chrome are available.

Which connectors to allow and the question to ask first

A connector plugs Claude into a tool: Drive, Slack, Notion, a CRM, or an MCP server built in-house.

Claude inherits each person's permissions in the connected service: if someone has no access to a file or a channel in the source tool, the connector can't reach it from Claude either.

The day you plug in a Drive connector, you expose an access problem you already had. Folders shared “with the whole company” 3 years ago suddenly become searchable in plain language, by someone who would never have thought to go digging.

Custom connectors link you to services Anthropic hasn't verified. The documentation asks you to connect only to servers from trusted organizations, and to review the permissions requested.

Before I connect one, I ask myself whether I'd sign off on that access for a human contractor. 4 sub-questions follow from it.

1. Who publishes this connector? If nobody in the room can name the publisher, the answer is no.
2. Read only, or read and write? Read-only access covers the vast majority of marketing uses, and a connector that can't write anything can't erase anything.
3. Which account does it connect with? A named account carries that person's rights, including the ones they inherited and forgot.
4. Who knows how to cut it off, and how fast? A connector nobody knows how to revoke has no business being plugged in.

On Team and Enterprise, an owner first enables the connector for the organization, then each person connects to it with their own account. On Enterprise, organization-managed authentication, in beta, lets you authorize a connector once for the whole team.

The usage policy that fits on one page

These habits hold when someone writes them down and someone owns them.

Who decides. A name. In the teams where it holds, the person comes from marketing and the topic is in their job description. I often pick the most cautious person on the team, the one who's been asking the awkward questions from the start. A convinced skeptic brings 5 colleagues along, and knows exactly where things break.

What the page contains. 7 lines are enough, and they take 2 minutes to read.

1. The approved plans, and a ban on personal accounts for anything client-related.
2. The short list of what you never paste.
3. The rule for preparing a file before sending it, with the name of the person to ask for help.
4. The trusted folders open to Claude, named one by one.
5. Manual mode on every client account, and a ban on the no-checks mode.
6. The approved connectors, each with the name of someone who knows how to cut it off.
7. The date of the next review.

The date matters as much as the rest. Between June 15 and August 18, 2026, 5 of the Anthropic pages cited here were updated, then Chat and Cowork merged on September 16. A policy without a review date quietly goes out of date. I schedule the review every quarter in the calendar, with a name next to it.

This written page does 2 jobs. It frames everyday habits, and it documents your approach: Article 4 of the AI Act has required, since February 2025, measures to develop AI literacy among your employees and the people who use AI on your behalf, and it leaves the format and duration up to you. Since its July 2026 revision, it specifies that the duty covers the measures taken, whatever level each person reaches. A written record and documented support are enough to show that you acted.

If you're starting from zero on upskilling your team, I mapped out the possible paths in my guide to Claude training, from free self-study to team coaching.

Where to start on Monday morning

Allow half a day, and a point person who owns the page afterward.

In order: the inventory of who uses which plan, the list of what you never paste, the trusted folders open to Claude, then the inventory of connectors. The rest gets sorted out as you go. To see where your team stands before you start, the free AI marketing assessment gives you a score in 6 minutes (the report is in French).

The scenario that really breaks something, I always see in the same place. A client file pasted on a Friday evening into a personal account, by someone nobody had told where the line was.

On your team, who could say today which connectors are plugged in?