How I work

My own AI data handling policy

I sell you a policy for handling data in AI tools, so you should be able to read mine.

The tools I use

Before an engagement begins, I identify the AI tools I propose to use, what each tool will do, and what information it may receive. I use only the tools you approve in writing. If the work would benefit from a different tool later, I explain the reason and wait for your written approval before using it with your material.

Whether your data enters them

I do not enter your material into an AI tool unless we have agreed on the tool, the purpose, and the type of information involved. I use the minimum material needed for the task and remove or mask identifying details where practical. Sensitive, confidential, privileged, regulated, or personal data is handled only after we agree in writing on the safeguards, access, and approved tools. Do not send that material through a public form or ordinary email unless we have agreed on a secure method.

Retention

I keep working copies of client material only while they are needed to deliver the work and complete the handover. Unless our contract or the law requires a different period, I delete remaining working copies within 90 days after the engagement ends. Provider backups may expire on their normal schedules, and limited records may be retained when needed for tax, accounting, dispute, insurance, security, or other legal obligations.

Subprocessors

Before a third-party provider receives client material, I tell you which provider I propose to use, what it will do, and what type of material it may process. That may include approved AI, file storage, communication, or delivery services needed for the engagement. I do not add a new provider that will handle your material without first disclosing it and obtaining your written approval.

Training

I do not use client material to train models for WBC AI Change Group. For third-party AI tools, I use account settings or service terms that prevent your material from being used to train the provider's general models where those protections are available. I will not use a tool without those protections unless I explain the exception and you explicitly approve it in writing.

At the end of an engagement

I hand over the agreed deliverables and client-owned materials, remove access that is no longer needed, and delete remaining working copies within the retention period above. On request, I will confirm when that deletion is complete. This does not override records I must retain by law or contract, and copies held in provider backups remain subject to the provider's normal secure expiration schedule.