# Sort GTM data into four buckets before pasting it into Claude

Sort competitor notes, transcripts and pricing sheets into four Claude input buckets, then check the plan and model-improvement setting that affect the choice.

URL: https://www.hiresteve.ai/blog/safe-gtm-data
Updated: 2026-10-12

Before pasting a competitor note, a call transcript or a pricing sheet into Claude, put it in one of four buckets: paste as-is, redact first, get approval first, or keep out. Then check two account facts: the plan and the model-improvement setting, because they decide which bucket an input belongs in. The original file stays in your own storage; only the cleared version goes in.

## What leaves your control when you paste

Pasted text becomes part of a conversation stored in your Claude account. On the Free, Pro and Max plans, Anthropic's [model-training article](https://privacy.claude.com/en/articles/10023580-is-my-data-used-for-model-training), checked September 14, 2026, says a chat is used to improve Claude only when you have turned that setting on, when the conversation is flagged for safety review, or when you have explicitly joined a program such as a trusted-tester group. Feedback you submit on a response is kept for up to five years.

Anthropic's [guidance on sensitive data in chats](https://support.claude.com/en/articles/8325621-i-would-like-to-input-sensitive-data-into-free-claude-ai-or-claude-pro-who-can-view-my-conversations) adds that access to conversations used for training is limited to a small number of personnel involved in model training, and asks users to be thoughtful about sharing financial, health, password or confidential information. The setting decides whether a conversation can be used for training. A safety flag can put it in front of a reviewer regardless.

Both articles cover consumer plans. The model-training article points commercial users to separate terms. Read the page for your own plan before relying on any of this.

## Sort the input into one of four buckets

| Bucket | Typical GTM inputs | What to do |
| --- | --- | --- |
| Paste as-is | A competitor's public pricing or feature page; your own published messaging; internal notes with no customer names, account IDs or unpublished figures | Paste it. Note the source URL and the date you copied it. |
| Redact first | Call transcripts, win/loss notes, sales notes, internal pricing sheets, competitor analysis that names customers or quotes deal figures | Remove direct identifiers and generalize distinctive values. Then check indirect and contextual identifiers; paste only if the authorized policy, contract and vendor-use checks allow it. |
| Get approval first | Customer quotes covered by an agreement, anything under NDA, unpublished financials, roadmap or M&A material | Use the organization's authorized privacy or legal process. Confirm that company policy, applicable customer or recording terms and the vendor's storage and use terms permit this disclosure. |
| Keep out | Credentials and API keys, health or payment data, anything you are not personally cleared to share | Do not paste it, on any plan. Write the point you need in your own words instead. |

The cloudpack.jp guide on [security settings before adopting Claude](https://cloudpack.jp/column/security/claude-security-settings-guide.html) (April 2026) lists competitive-analysis results, new-product plans, M&A deliberations and unpublished financials as the categories to protect before a company adopts Claude. All four are everyday PMM inputs, which is why the sorting has to happen on every paste.

When an input straddles two buckets, take the more cautious one. A transcript with one customer name is a redact case. A transcript that would still identify the customer after the name is gone is an approval case.

## Check the plan and the setting before trusting the rule

First, the plan. Free, Pro and Max are consumer plans covered by the articles above. Team, Enterprise and API are commercial plans with their own terms. Anthropic's [Project visibility and sharing guide](https://support.claude.com/en/articles/9519189-manage-project-visibility-and-sharing) says organization-wide sharing of a Project exists only on Team and Enterprise, so on a consumer plan every Project is personal.

Second, the model-improvement setting under Settings and Privacy. Open it and read the current state; do not rely on what you remember setting last year. The model-training article says Incognito chats are excluded from model improvement even when the setting is on. On a consumer plan, Incognito is our suggestion for a one-off paste of redacted material that has also passed the indirect-identifier and authorization checks above.

If you are on a consumer plan with the setting on, every redact-first input moves up a bucket: turn the setting off, or complete the approval process above before pasting.

## Redact so the passage still does its job

Redaction has to keep the passage useful. Swap a customer name for a role ("a mid-market fintech buyer"), a competitor's name for a label you keep in a key outside Claude, and exact figures for ratios or ranges. "About 30% below our list price" says what the analysis needs without exposing the sheet. Both examples are invented for this lesson. cloudpack.jp's guide recommends the same two moves: company-name placeholders, and ratios in place of absolute figures.

Keep the unredacted original in your own storage with the key beside it, and paste only the cleared version. The key lets you restore names in Claude's output for internal use.

After redacting by hand, ask Claude to help spot remaining identifiers:

```prompt
Read the text below. List every phrase that could still identify a specific
person, customer, account or company, including distinctive numbers, product
names, dates and turns of phrase. Do not rewrite the text; list the phrases
and say why each one identifies someone.
```

**Redaction can still leave identifiers**

None of the sources opened for this lesson claims that removing names de-identifies a document. A unique metric, an unusual phrasing or a combination of context clues can still point to one customer. If Claude's list or your own read finds one, the input moves to the approval bucket.

## Set Project visibility before adding material

If the same class of material comes up weekly, keep it in a Claude Project; the [Project setup lesson](/blog/claude-project-setup) covers the instructions and files. Before the first upload, open the Project's settings.

On Team and Enterprise, a Project is private or visible to the organization, and each member has "can view" or "can edit" access, per the visibility guide above. Set visibility to private for anything in the redact or approval buckets, add members by name, and give "can edit" only to people who should be able to change the files. On a consumer plan there is no membership to check, and the plan's training setting applies to whatever you upload.

## A short check before each paste

- The input has a bucket, and the bucket's action is done.
- The plan and the model-improvement setting were read from Settings today, not remembered.
- Direct, indirect and contextual identifiers were reviewed; policy, applicable terms and vendor use permit this upload; the key lives outside Claude.
- The Project's visibility and member list match the material's bucket.
- The original file is still in your own storage, unchanged.

## Where the rule runs out, and where Steve fits

The rule covers one person deciding about one paste. It does not verify that a redaction worked, it does not stop a colleague from pasting the original, and it ends when the output leaves your account, whether in a shared Project, a Slack message or a battlecard. A solo PMM has no data-loss-prevention tool watching for that. Strac sells one, and its [guide to whether Claude is safe](https://www.strac.io/blog/is-claude-ai-safe) is written for security teams. The DIY answer is the checklist above plus an authorized privacy or legal approval path. The [battlecard feedback lesson](/blog/battlecard-feedback) applies the same removal of identifiers when material goes out to sellers.

Once material has cleared your triage and needs a place where sales can use it, see [Steve competitive intelligence](/products/competitive-intel) for the product overview.

## Frequently asked

### Does Claude train on what I paste?

On Free, Pro and Max, only if the model-improvement setting is on, the chat is flagged for safety review, or you joined a program such as a trusted-tester group, per Anthropic's training article checked September 14, 2026. Team, Enterprise and API have separate commercial terms; read the page for your plan.

### Is a redacted call transcript safe to paste?

Not necessarily. Remove direct identifiers, then check distinctive phrases, dates and context. Paste only if your organization's authorized privacy or legal process confirms that company policy, applicable customer or recording terms and the vendor agreement allow that use. Otherwise, keep it out.

### Can I paste a competitor's pricing page?

Yes. A page the competitor publishes is already public, so it belongs in the paste-as-is bucket. Record the URL and the date you copied it; the page will change, and the date is what makes the analysis checkable later.

### What if my company has no AI data policy?

Use the four buckets for interim triage, then ask your privacy or legal owner to define the authorized approval path before controlled records are pasted. This is our recommendation, not a legal standard. Applicable contracts, policy and law still govern.