PinoyRemote
Before putting client information into an AI tool, confirm that the client has approved the tool and the specific use. Then reduce the information to what the task needs, check the account’s controls, and review the result before sharing it.
I use automations in Airtable and n8n, including deadline reminder emails. My clients have told me I can build the automations I need, and they also encourage AI use for simple, repetitive tasks.
Kung may ganitong permission ka rin, clarify what it covers before adding a new service or sending it client records. Permission to automate a task still leaves practical questions about the data, the account, and who will receive it.
The recommendations below can help you work through those questions. A training setting is only one part of the process: the information still goes to a service with its own access, storage, and retention rules. When real records are unnecessary, start with a generic description or made-up sample data.
Agree on the workflow before uploading
Ask which tool and account you should use, which tasks are allowed, and which information may be included. Kung malinaw na ang approved workflow, follow it. Ask again when a new tool, data type, recipient, or purpose falls outside that scope.
A client might approve drafting a public social caption while prohibiting customer records in a personal AI account. Approval for one task should not be expanded into every future use.
Clarify these points:
- Approved tool and workspace
- Permitted task
- Data allowed and data excluded
- People who can access the input and output
- Retention or deletion requirements
- Who reviews the result
- Who to contact if something goes wrong
Sample approval question
“Can I use [tool and workspace] to help draft [specific output] using [the proposed information]? I can work from a generic summary if the source file should stay inside your systems. Please confirm the approved data and review process.”
Record the answer in the client’s normal documentation. Kung hindi malinaw kung puwedeng isama ang isang file, huwag muna itong i-upload. Ask the appropriate person to clarify the boundary.
Sample deadline reminder workflow
A deadline reminder is a useful place to check how much automation the task actually needs. Airtable’s automation guide documents scheduled triggers, conditions, and email actions using selected record values. For a fixed reminder, a date rule and an approved message template may be enough.
This sample is a design you can adapt with the client. The fields and checks below are suggested safeguards.
- Choose the trigger. Define when a reminder should run and which status qualifies. Agree on the time zone and what should happen if the deadline changes.
- Choose the minimum fields. A reminder might need a task label, due date, and approved recipient. Keep unrelated notes, attachments, and private records out of the message and any unnecessary processing steps.
- Map where those fields go. List the database, automation service, email service, and any AI provider involved. Kung may bagong service na madadagdagan, check kung kasama iyon sa approval bago magpadala ng data.
- Test with made-up records. Check the recipient, message, missing dates, completed tasks, and duplicate sends. Test an error case too. Make sure someone knows how to pause the workflow and handle a failed run.
- Review the sending rule. Agree on whether the client wants a draft for review or an automatic send within defined conditions. A wrong recipient or repeated message can cause problems even when the wording looks correct.
If AI would help improve the wording, you could use it to draft a generic reminder template without real client details, then review the template before placing it in the approved workflow. Hindi kailangang dumaan sa AI ang bawat record para lang makapag-send ng reminder.
Check what the automation saves
Airtable’s guide shows that test results and run history can include record values. Check who can view those details as well as who receives the email.
For self-hosted n8n, its execution-data guidance recommends saving less unnecessary execution data and pruning older records. Ask the person managing the actual setup which controls and exceptions apply.
Also distinguish hiding data in a screen from stopping disclosure. n8n’s Enterprise execution-redaction documentation says redaction does not stop data passing between workflow steps or going to external services, and it does not remove the underlying database data. Trace the destination even when a run-history view looks blank.
Understand the privacy responsibilities
The Philippine NPC’s AI advisory applies existing Data Privacy Act principles to AI processing personal data. These include lawful basis, transparency, minimization, security and accountability.
The client’s approval and the lawful basis for processing a person’s information are separate questions. Consent is one possible basis in relevant circumstances, rather than the only legal basis for every task.
Your role also depends on the arrangement. Under the DPA implementing rules, processors have duties and must follow the appropriate documented instructions. Outsourcing does not remove the controller’s accountability.
Ask the client’s privacy or security contact to resolve legal questions about a new service or data use. Avoid assuming that being a VA automatically places all responsibility elsewhere.
Use the least information needed
Bago mag-upload ng file, check kung kailangan ba talaga ang buong file para sa task.
For an email draft, you may only need the purpose, tone and next action. For a formula, a small sample spreadsheet may be enough. For a checklist, you may be able to provide a generic process with no customer details.
Prepare that reduced version inside the approved environment first. Sending the complete file to AI and asking it to remove personal information already discloses the original file.
Demo vendor follow up
Suppose you want help wording a reminder about a missing delivery date. A practice prompt could be:
“Draft a short, polite message asking a supplier to confirm the delivery date for an outstanding order. Ask for an update by [approved date]. Leave names, order references and amounts as placeholders.”
You can add the real details later inside the client’s approved system, after checking the wording and confirming the date.
This example uses a generic task description. It does not require a supplier contract, a full order spreadsheet or an inbox screenshot.
Check indirect identifiers too
Replacing a name with “Client A” can still leave enough context to identify someone.
A rare incident, exact dates, location, job title or a combination of details may identify a person. A retained lookup table can also connect a placeholder back to the original record.
The NPC explains that pseudonymized information remains personal data. Treat a placeholder version as information that still needs an appropriate basis and safeguards.
Check hidden or easily missed material:
- Spreadsheet tabs, comments and formulas
- Document comments and tracked changes
- File names and metadata
- Email signatures and quoted threads
- Browser sidebars and notifications in screenshots
- Links that expose private records
Kung wording lang ang kailangan mo, a short generic description may be enough. Avoid uploading a full file just because it is convenient.
Know the difference between training and retention
Training controls affect how a provider may use content to improve models. Retention, human review, sharing and connected services involve additional rules.
The details vary by product and plan.
| Tool or account | A current control to check | Important additional question |
|---|---|---|
| Personal ChatGPT | Improve the model for everyone under Data controls | What remains in history, retention or feedback handling? |
| Consumer Claude | Help Improve our AI models under Privacy | What applies to saved chats, feedback and safety review? |
| Personal Gemini | Keep Activity and Temporary Chat | What retention and connected-app rules still apply? |
| Managed business workspace or API | Contract, admin controls and product-specific policy | Is this workflow and data approved for that account? |
Check the actual account you will use. A personal subscription and a client-managed workspace can have different terms.
ChatGPT
OpenAI’s current data-controls guidance says turning off Improve the model for everyone stops new conversations being used for model training. Saved chats remain unless separately removed.
Temporary chats are not used for training while they remain temporary and may be retained for up to thirty days for safety. Feedback can include the associated conversation for training, so follow the client’s policy before submitting it.
Managed workspaces have their own privacy, retention and access settings. For API work, OpenAI’s data-controls documentation distinguishes default no-training treatment from abuse monitoring and feature-specific storage.
Claude
Anthropic’s consumer privacy-setting guide explains the model-improvement control.
Its training policy also addresses Incognito chats, feedback and safety exceptions. Review the retention rules before assuming a chat disappears after a fixed period.
Gemini
Google’s Gemini Apps Privacy Hub explains Keep Activity, temporary chats, feedback and human review.
Google says temporary chats and chats made with Keep Activity off are retained with the account for 72 hours. With Keep Activity off and no feedback submitted, future chats are not used to improve its AI models. Human review for safety, previously reviewed material, and connected apps involve additional rules.
Use the client’s admin guidance for a managed Workspace account instead of applying personal-account instructions automatically.
Ask separately about recording and AI processing
For meetings, confirm permission to record or transcribe before capture starts. Also confirm which service may process the recording, who can access it and how long it should be retained.
Permission to record a call does not automatically approve uploading it to any AI service.
Follow the client’s process for participants, including customers or other external attendees. If recording is declined or the approved setup is unclear, take manual notes.
Review transcripts and summaries for names, decisions, deadlines and accidental disclosure. Share only the material the recipient needs.
Treat public lead information carefully
A public profile can still contain personal data. The NPC’s 2026 scraping advisory addresses the use of publicly available personal information and the need for a lawful purpose and basis.
Before using an AI or scraping tool on a prospect list, ask what data is needed, how it will be used and which source and method are approved.
Follow the source site’s applicable restrictions and avoid bypassing technical safeguards. Do not assume that a client’s request to “collect leads” answers every privacy and access question.
Check the output before delivery
The output can repeat confidential details, infer information you did not intend to share or add an unsupported statement.
Review it in the approved environment. Tama ba ang recipient? Kailangan ba talaga ang attachment? Check sharing settings before sending or creating a link.
Keep access limited to the intended people. Avoid public share links for client work unless that publication is specifically authorized.
You should also check accuracy. A private but incorrect answer can still cause problems when it becomes a customer response or business decision.
If information reaches an unapproved tool
Stop the affected workflow and promptly contact the client’s designated privacy or security person.
Preserve a factual record of what was shared, when, with which tool and account, and what containment steps were taken. Huwag basta mag-delete at isipin na tapos na. Follow the incident procedure so the responsible team can assess what happened.
NPC Circular 16-03 sets notification requirements for breaches meeting its criteria. The seventy-two-hour rule is not a universal deadline for every mistake, and a contract may require faster internal reporting.
Let the responsible team assess notification and further action. Keep evidence secure and avoid spreading the exposed material while asking for help.
Keep the process clear
Use the approved tool for the approved task, minimize the input, and check the result. Review settings when the account, product, or client requirements change.
When asked about AI, describe what you actually use and how you handle the information. Clear, accurate answers are more useful than a blanket claim that everything is manual or completely safe.
Start with one clear workflow. Alamin kung anong data ang kailangan, saan ito pupunta, at sino ang magche-check kapag may problema. That is a more useful foundation than assuming every automation needs AI or every AI setting covers the whole process.
