Your Personal Email Is Not Confidential
A lot of early-stage founders I meet run their nascent business out of a personal Gmail account. It's free, fast and already there on their phone. Contracts, cap tables, customer lists, investor updates, and the occasional "can you look at this NDA before I sign it?” That habit now carries more risk than it did a year ago.
What changed
Gmail has Gemini built in. Summaries, smart replies, and natural language search across your whole inbox. In the US, those smart features are on by default for personal accounts. In Europe they require opt-in. To do any of it, Google processes the content of your email. That's the trade.
Separately, there's the Gemini app. Google's own Privacy Hub tells users not to enter confidential information. A subset of chats goes to human reviewers. Reviewed chats are kept for up to three years, and deleting your activity doesn't touch them.
Now compare Workspace, the paid business version. Google's published commitments there are that your content isn't human reviewed or used for model training outside your domain without permission.
Why a lawyer cares
Confidentiality sits underneath a lot of things you want to protect. Attorney-client privilege. Trade secrets. NDA obligations. The commitments in your customer contracts and security questionnaires. None of those require perfection, but all of them require a reasonable level of care.
I'm not telling you that using personal Gmail waives privilege. I'm telling you it hands the other side an argument. "The founder ran it through a free consumer account with AI features switched on by default" is a sentence you never want to hear in a deposition, a diligence call, or a customer audit.
What to do
Move business email to a paid business account on your own domain.
If you're stuck on personal Gmail for now, turn off smart features in both places: Smart features and personalization in Gmail settings, then Workspace smart features. Expect to lose some convenience.
Stop pasting contracts, investor materials, and customer data into consumer AI tools. Use business or API tiers whose terms say your inputs aren't used for training.
Read the confidentiality clauses in your NDAs and customer agreements. Check what standard of care you promised.
Tell your team. One cofounder on a personal account undoes everyone else's good habits.
Your inbox is the filing cabinet for your company, so make sure it’s actually locked!
