Hartwell Bookkeeping: team AI policy (one page)
(From the Stepthrough lesson "ChatGPT: Keep Client Data Safe". Hartwell Bookkeeping is made up: replace the firm name and the policy owner with yours. This is not legal advice; your client contracts and local rules come first.)

1. One approved account: Staff use only the firm-approved ChatGPT account. No client work on personal logins. Use a business plan if you can; they don't train on your data by default.
2. Improve the model for everyone: off: Settings, Data controls. Check it on every account used for work, and re-check after any plan change.
3. Memory: off on shared logins: Settings, Personalization, Enable memory off, so one client's details never turn up in another client's chat.
4. Temporary Chat for anything sensitive: It ignores memory and stays out of your history. Remember: a copy can still be kept for up to 30 days.
5. Never paste: Passwords, full bank or card numbers, Social Security numbers, health details, or files a client asked you to keep confidential. Use placeholders like [CLIENT].
6. Shared links: review monthly: Settings, Data controls, Shared links, Manage. Delete any link nobody needs. Anyone with the link can read the chat.
7. Export before you delete: Export data first if you may need a record. Only the account owner deletes chats, and only with a reason.
8. Ask when unsure: Priya owns this policy. Questions and mistakes go to her the same day, with no blame for reporting.