An AI use policy for your sales team: what may be pasted where

A salesperson pastes a sheet of customers into a free chatbot to get thank-you notes written, and nothing visible goes wrong. That is the problem. Nobody can say where the sheet went, who might see it, or whether it was allowed. A sales team's AI policy needs only three decisions on one page. Which tools are approved? Which kinds of information may go into them? Who reads a message before a customer does? A firm that writes nothing may find its rule only when someone pastes the wrong spreadsheet.

What does the page say?

Here is a draft you can copy. Square brackets mark where your facts go.

How we use AI tools in sales and marketing

1. For work we use only these tools: [list]. No personal accounts for work content.
2. Information comes in three kinds. Public text may go into an approved tool. Internal material may go in only if names are removed. Private material never goes into any AI tool.
3. Private means a customer's name with a phone number or email, and any quotation or contract. It means bank or tax details, anything about health, identity papers or children, passwords, and plans not yet announced.
4. Whatever a tool writes is a draft. A named person reads it before it reaches a customer.
5. If you are unsure, ask [name] before you paste.
6. If something went in by mistake, tell [name] the same day. Nobody is punished for reporting.

The last line matters most. A team that fears blame hides its mistakes, and a hidden mistake cannot be repaired.

For a doubtful item, use one test. If it were read aloud in a customer's shop, would anyone mind? If yes, it is private.

Which arguments will I have to win?

A policy meets resistance in three predictable places.

"It is only a draft, I will fix it." True, and the fixing is the point. Ask who reads it. For cold messages to new prospects, the salesperson reads and sends, and the sales head reads a sample. For anything with a price, a promise or a date, a second person reads first. For a reply to a complaint, or any message about money owed, a person writes it from the start. The reader is not checking spelling. They check that every claim is one the firm will stand behind.

"I used my own phone and my own account." That is the real reason to list approved tools. A personal account has no owner you can name, and its history goes with the person when they leave. Offer one approved tool, put its owner's name on the page, and ask people to move across.

"It was just this once." Many slips begin that way. The answer is the six-line page plus the last rule, which makes owning up cheaper than hiding.

What happened in Ajmer?

Imagine, as an invented example, a travel agency in Ajmer that arranges pilgrimage trips for families, with a team of seven. A coordinator pasted a sheet of that season's travellers into a free assistant to write personal messages. The sheet held names, phone numbers, ages and in some rows a note about a health condition, because the coordinator needed it for seat planning.

Nothing visible happened, and the owner found out only because the coordinator mentioned it. Whether the sheet could be recovered or deleted from the tool was a question nobody could answer. The owner did not ban the tool, and wrote the page above and moved that sheet, and anything like it, into the private kind. The team got a different habit. Write the message once with a blank where the name goes, tidy the wording in the tool, and merge names later in the agency's own sheet. The same messages went out and the traveller data stayed in the sheet.

The owner also found that two coordinators used different free tools on their own phones. The page named one approved tool. One coordinator moved across at once; the other kept using a personal account for a month, until the owner sat with that coordinator and moved the chat history.

What do I record, and for how long?

A small log is enough, with four columns: date and person, tool and job, kind of information used, and who reviewed the output.

If a customer asks how their details were handled, you can answer. If one message goes wrong, you can see which habit caused it. Look at the log when a new tool arrives or when something has gone wrong, not on a calendar that nobody follows. Keep it free of the private details themselves: it records that a sheet was used, never what the sheet said. Ask your adviser how long to keep it.

What the page does not do

It does not make a tool accurate. Assistants state wrong things in confident language, and no policy changes that. It does not replace consent rules for messaging customers, which are a separate matter. Our post on consent and marketing data covers what to check. And it does not settle the law. Rules on personal data differ and change, so have your own legal adviser read the page once. Do this especially if you handle health, money or children's details, as the Ajmer agency does.

Agree the page with the people who will follow it

Before it is final, hand the draft to the team. Ask each person which kind they would put their last three pasted items in, and change the page wherever they disagree with you. Each disagreement marks a sentence that was unclear.

Your first task is small: copy the draft, fill the brackets, and ask each person which kind their last three pasted items belong to. Choosing the tools comes after that, and an AI readiness checklist sets out the questions. AI readiness and governance is the service for this stage, the marketing hub holds the other AI posts, and when the page is ready for a trial, tell us what you need.