Before you connect an AI assistant to your client data

You paste a client's name and the amount they owe into an AI chat, ask it to draft the chase email, and it works. So you do it again the following week. A month later one of your tools offers to connect the assistant directly, no more pasting, and you click yes because by then it feels like the same thing you have been doing all along.

It is not quite the same thing, and the difference is worth about five minutes of your attention.

Who is actually in the chain

Four parties end up holding something here, and only one of them chose to be involved.

Your client hands you their name, email, address and eventually their payment history. They did that to get a job done, and that is the whole of their involvement. They have no idea what software you use.

You hold it. In data protection terms you are the controller: you decide what happens to it, and the duty to be straight with your client about that sits with you, not with any tool you buy.

The assistant is the one you connect, and its provider is a company like Anthropic or OpenAI. When you ask it something, whatever your tools return travels to that company's systems and stays in your chat history there, under whatever terms you accepted when you signed up to it.

The connector is the pipe between your tools and the assistant, and it is the only part of this you get to control the shape of. It decides which questions the assistant is even allowed to ask, and how much comes back for each one. That is why the rest of this post is about the connector rather than the assistant.

Why anyone bothers

It is worth saying plainly that this is genuinely good when it works. Monday morning, you ask what needs chasing and get the actual list out of your own records: two invoices past due, a proposal that has been sitting unopened for nine days, a client you have not billed for last month's work. No opening five tabs to assemble it yourself.

Then you say "draft the invoice for the hours I logged on the rebrand" and it is there, in your account, with the right client and the right numbers, waiting for you to check it. The admin that used to eat a Sunday evening becomes a conversation you have while the kettle boils.

That is the payoff, and it is real. The rest of this is about keeping it that way.

The question worth asking

When you paste, you decide what the assistant sees. When you connect, the connector decides, and you find out afterwards. So the thing worth establishing up front is what it is allowed to do while you are not watching.

Sort the actions by what happens when they go wrong and it gets concrete fast.

If it reads your invoices and clients and gets something wrong, nothing in your business changes. The cost is exposure: whatever it read has gone to the assistant's provider and is sitting in your chat history. You might be perfectly relaxed about that, but it is worth knowing it happened.

If it drafts a proposal or an invoice and gets it wrong, you delete it. Nobody outside your account ever saw the thing. That is a bad five minutes, not a bad week.

If it sends, there is no undo. An invoice for the wrong amount, in the wrong client's inbox, is now a conversation you have to have. Same for a contract that went out for signature, or a payment that moved.

So the thing to establish, before you approve anything, is which of those three the connector can do. A tool that reads and drafts is in very different territory from one that can email your client while you are making coffee. If you cannot get a straight answer, treat the lack of one as the answer.

What you owe the client

Which brings us back to the one party in that chain who never agreed to any of it. You accepted your tools' terms; your client accepted nothing. The ICO's guidance on the right to be informed is refreshingly plain about what that means in practice: people are entitled to know who is processing their data and why.

It does not need a solicitor. It needs a paragraph in your privacy notice, and you are welcome to take this one:

AI assistants. I use an AI assistant to help me manage the admin on your project, including drafting invoices and documents and reminding me what needs doing. Your details may be read by that assistant when I ask it to help with your work. It never sends anything to you on my behalf, and I review everything before it leaves my desk. If you would rather I didn't process your details this way, tell me and I'll mark your record so the assistant can't see it. I use [Claude, made by Anthropic] and you can read their privacy policy at [link].

The one thing to decide on purpose rather than by default is which clients stay out of reach entirely: anything a client would call confidential, and certainly anything like health details.

Better still, ask them

Writing it in your privacy notice covers you. Asking the client covers you and settles it, because then you have their actual answer rather than a paragraph you hope they read.

The cheapest place to ask is your onboarding form, next to the questions about budget and deadlines, where a new client is already answering things. Something as plain as "Are you happy for me to use an AI assistant to help manage your project admin?" is enough. You get a dated yes or no from every client before their details go anywhere near one.

Then check you can see it and stop it

An activity log is the only way to answer "what has this been doing" a month from now. Find out whether the tool keeps one, and what goes in it, because recording that a tool ran at 4pm is a very different proposition from recording your whole conversation. Ask how long it is kept, too. Forever and it becomes a growing pile of data about your business with no expiry date; not at all and you have nothing to look at when you want to check.

Then find the disconnect button before you need it, and understand its limit, because this one catches people out. Disconnecting stops the assistant reaching your account from that moment onwards. What it cannot do is reach back and unread what it already saw. That history sits with the assistant's provider and you clear it there, in their settings. Any tool that markets disconnect as though it erases the past is overselling.

How we built ours

We put a Claude connector into HelloNoa and split the actions the same way. It reads your studio and prepares drafts, and today it stops there: sending, signing and taking payment stay on your side of the line. If we ever open any of that up, it will be because you asked for it and confirmed it, rather than an assistant deciding on your behalf.

On the client question, each client carries a privacy setting on their own page. Mark someone Private and they are never named to a connected assistant. Mark them Hidden from AI and they do not appear at all. Settings, Connected apps lists which tool ran and when, without your conversation, and we delete that log automatically after a year. Disconnect lives on the same screen.

The bottom line

None of this is an argument against connecting an assistant. It is an argument for spending five minutes on the permissions before you spend an hour on the prompts. Work out what it can do without you, put a line in your privacy notice, ask the clients you are unsure about, and keep the sensitive ones out of reach. Do that once, at the start, and you never have to have the awkward version of the conversation later.