Your CV, their take-home, and the terms

Three different questions, usually collapsed into one

People ask “is it safe to use AI for this”. That question has no answer until you split it:

1. Is this data mine to share?
2. What will the provider do with it?
3. Would I mind if it appeared in someone else’s output?

Most of the trouble comes from skipping the first.

Not yours to share

• An employer’s take-home exercise that the brief marks confidential. Some companies say so explicitly; assume it if the exercise is based on their real data or describes their internal problem.
• Your current employer’s code, data, documents, incidents or customer names. Your contract almost certainly covers this, and pasting into a third-party service is disclosure.
• Other people’s personal data. A referee’s phone number, a colleague’s name in a story you are polishing, a screenshot with an email address in it. Data protection law applies to you as an individual in several jurisdictions, and in all of them it applies to your employer.
• Identity documents. Passport, national ID, bank details. There is no job-search task that requires uploading these to a chatbot.

Your own CV is generally fine to paste. Strip your home address and phone number first: they are not needed for the task, and you have then removed the only sensitive parts.

What the provider does with it

Terms differ by provider and by tier, they change, and the last time you checked is not now. The stable shape, which has held across the major providers for a while:

• Consumer free and low-cost tiers may use your conversations to improve models, sometimes by default. There is normally a setting to turn this off, and it is normally not the default.
• Business, enterprise and API tiers typically do not train on customer content by contract. This is the difference that matters, and it is why an employer that has bought a licence usually wants you to use theirs rather than your personal account.
• ”We do not train on your data” is not “we do not keep it”. Retention for abuse monitoring is standard practice, commonly around 30 days, sometimes longer, and staff can review flagged content. That is reasonable operational practice and it is also a reason not to paste something you would not want a stranger to read.

The practical instruction: open the settings on whichever tool you use, find the training or data-controls section, and set it deliberately. It takes two minutes and most people have never looked.

The free option that removes the question entirely

A small open-weight model running on your own machine sends nothing anywhere. Ollama and llama.cpp are free, install in minutes, and run usable models on an ordinary laptop with 8 to 16 GB of memory: no GPU required, though it is slower without one.

They are meaningfully weaker than the large hosted models at reasoning and long documents. For the tasks in this module (reformatting, summarising, drafting, rehearsing, and anything touching a confidential exercise) they are entirely adequate, and this is the honest answer to “how do I use AI on my employer’s material”. You do not. You use a model that never leaves the room.

Two rules for the take-home specifically

Read the brief’s own instructions. An increasing number state their position on AI use directly: some forbid it, many now permit it and ask you to say what you used and why. Follow what it says, and if it says nothing, disclose briefly in the README. Nobody has ever been rejected for a sentence saying which parts were assisted; people are rejected for being unable to explain their own submission.

Never paste their proprietary data anywhere. If the exercise ships a real customer extract, work locally. This is one of the few places in a job search where a single decision can be a genuine breach rather than a bad look.

The limitation

Everything in this lesson is a snapshot of a moving target. Terms are rewritten, defaults change, regulators intervene, and a provider’s policy in your country may differ from its policy elsewhere. Treat the principle as durable (know whose data it is, and check the setting yourself) and the specifics as something to verify each time it matters.