🔒 Free Privacy App IT
← Observatory

Anonymising texts for chatbots without losing context

Think of a chatbot as a brilliant collaborator who does not need to know who the people you are telling it about are. To summarise minutes, rewrite a letter or draft a reply to a complaint it needs the facts, the order in which they happened, everyone's role and the right tone. Ms Rossi's name, tax number or address do not improve its work one bit. And yet those are exactly the data that, every day, end up pasted into the chat window (and, as the numbers below show, about half of those who use AI at work also do it with customer and company data).

Anonymising a text before giving it to a chatbot is how you separate these two things. You remove what identifies people and keep everything else. The delicate part is how you remove it. If you delete the data, or cover them with asterisks, the model loses the thread. It no longer knows who wrote to whom, who signed what, which person a sentence refers to, and the answer gets worse. If instead you put a placeholder such as [NAME 1], [COMPANY A] or [DATE] in place of each piece of data, the context stays intact. The chatbot understands that the text is about a person, a company or a date, tells who is who and works as if it had the original text in front of it.

This is how you use chatbots to the full of their capabilities without giving up confidentiality. You work on the same text, you get answers of the same quality and the people you are writing about stay out of the conversation. When the answer comes back to your computer, you put the real data back in place. It is also the road closest to the spirit of the European data protection rules, which ask you to use only the data you really need and to protect them from the start.

In this article we look at what anonymising a text means, which roads exist, how Retoria's Anonimizzatore IA works, how much time it saves you and how to do it from tomorrow in five steps. This is educational material, not legal advice.

Anonymisation, the family that hides identity

When this article talks about anonymisation it means the family of all the processes that hide the identity of people and the sensitive data contained in a text. That is the sense in which we at Retoria use the word, and it is why our app is called Anonimizzatore IA (AI Anonymiser). Within this family, however, there are two very different roads.

The first is pseudonymisation. You replace the data with placeholders that tell the chatbot what kind of information it is without revealing it, for example [NAME], [SURNAME] or [TAX NUMBER], and you keep a correspondence table aside that lets you put the real data back. The second is full anonymisation. You remove the data or generalise them until the person can no longer be traced, and you keep no key at all. The first hides identity and leaves you a way back, the second erases it for good.

Table showing the same sentence treated in three ways, original, pseudonymised with placeholders and a correspondence table, fully anonymised with generalised data, and for each whether one can go back to the person and what the chatbot receives The same text treated with the two branches of anonymisation. Pseudonymisation hides the data and lets whoever has the table put them back, full anonymisation erases them. Retoria elaboration on the GDPR and guidance from the European data protection authorities.

Pseudonymisation, or hiding the data and keeping the key

It is the branch that matters most to anyone working with chatbots. The GDPR knows it well too and describes it, in essence, as a way of processing data so that they can no longer be attributed to a specific person without additional information, which must be kept separately and protected.

In practice you replace identifiers with placeholders (or, less often, with invented names) and you keep a correspondence table somewhere (Person 1 is Mario Rossi, Body A is the tax office of your municipality). Whoever has the table can go back. Whoever does not sees only placeholders.

Why is it worth it? Because the GDPR explicitly lists it among the measures that protect data, and the European data protection authorities explain that it reduces the risks for people, because it prevents data from being attributed to someone while you use them and also in the event of unauthorised access. With placeholders, moreover, the chatbot keeps all the context it needs to work well. And since you keep the key, you can always go back to the original text, which is exactly what you need when working with a chatbot.

Full anonymisation, or no longer being able to go back

Full anonymisation is the most radical branch of the family. Data are anonymous in this strict sense when they can no longer be traced back to any person, taking into account all the means someone could reasonably use to do so.

The European data protection authorities sum up this criterion in three questions. Is it still possible to single out a person in the data? Is it possible to link together records about the same person? Is it possible to infer something about them? Only if the answer to all three is no can the data be called anonymous in the strict sense.

The bar is high, and research shows why. In 2000 Latanya Sweeney, at Carnegie Mellon University, calculated that with 1990 United States census data three pieces of information, namely ZIP code, date of birth and sex, were enough to single out 87% of people. No name, no tax number. Replacing the ZIP code with the city brought the share down to 53%, and with the county alone to 18%. Geographic detail, in other words, weighs more than the name. In 2019 Luc Rocher, Julien Hendrickx and Yves-Alexandre de Montjoye then estimated in Nature Communications that with 15 demographic attributes 99.98% of Americans would be correctly re-identified in any dataset, even an incomplete one (it is an estimate from a statistical model and not a test on a real archive, but the direction is clear). The more detail you leave, the more visible the person becomes again. And it is not only about personal details. In 2008 Arvind Narayanan and Vitaly Shmatikov showed that the "anonymous" film ratings dataset released by Netflix for a competition, about 500,000 subscribers, could be linked back to people by comparing a few ratings with those published on IMDb, to the point of revealing sensitive preferences too.

Bar chart with the share of Americans who can be singled out by combining date of birth and sex with the ZIP code, with the city or with the county How many people can be singled out with date of birth, sex and an increasingly precise geographic detail. Source Sweeney, Carnegie Mellon University (2000), on 1990 United States census data.

That is why data that are anonymous in the strict sense are, as a rule, data transformed in depth (aggregated, generalised, with the detail gone) and not simply data without a name. And for the same reason the European authorities warn that not even an AI model trained on personal data can always be considered anonymous, since in some cases those data can be extracted from the model itself.

For anyone working with chatbots, however, full anonymisation comes at a cost. The more you generalise, the more detail the text loses, and with the detail it loses usefulness. A report in which every person becomes "someone" and every date "one day" cannot be summarised or rewritten well. That is why, when the goal is to work with AI, the most practical road is usually placeholders.

Where the key is kept

In 2025 the Court of Justice of the European Union also returned to pseudonymised data, recalling that in assessing them it matters a great deal who really has the means to trace the people.

Translated for anyone working with a chatbot, where the key is kept matters a great deal. If the correspondence table stays on your computer and the service provider only receives the text with placeholders, you have concretely reduced what that provider can learn about the people you are writing about.

How much company data already ends up in public chatbots

This is not a theoretical risk, it is a habit. The study by Kristjan Prenga cited below devotes a whole chapter to these data, and the figures in the original University of Melbourne and KPMG report are clear. 58% of workers use AI intentionally and regularly, mostly with free public tools such as ChatGPT rather than those provided by their employer. About half of those who use it (48 to 49%) have uploaded sensitive company information into public tools, namely financial data, sales figures or customer information, or copyrighted material. 56% have used AI at work without knowing whether it was allowed, and 63% have seen colleagues use it inappropriately.

The most instructive figure is another one. Uploading sensitive data is more frequent where AI is banned (67%) and where an internal policy exists (56%) than where there is no rule at all (33%). A ban, in other words, does not stop use, it only makes it invisible (we wrote about this in our article on shadow AI). The best known case remains Samsung, which in May 2023 suspended the use of chatbots on company devices after some engineers had pasted internal source code into ChatGPT.

Two bar charts, on the left how many workers use AI, use it without knowing whether it is allowed and have uploaded sensitive company data, on the right how many upload sensitive data depending on the company rule AI use at work and uploading of sensitive company data into public tools, by type of company rule. Source University of Melbourne and KPMG (2025), 48,340 people in 47 countries.

And once it is in there? Chatbot apps collect much more than the text you type. According to Surfshark's analysis, updated in March 2026, of the ten most downloaded AI apps on the App Store, each collects on average 14 types of data out of 35 possible (Meta AI 33, Gemini 23, ChatGPT 17), and 70% collect location. Then there are the incidents. In January 2025 Wiz researchers found a DeepSeek database open to anyone, without a password, with more than a million log lines that also contained user conversations and access keys. In February 2025 an attacker claimed to have published the contact details of about 30,000 OmniGPT users and more than 34 million lines of conversations (a claim the platform has not publicly confirmed).

For an organisation this is not acceptable for two distinct reasons. Data about customers, patients or students are personal data, and the GDPR asks you to use only those you really need and to protect them. Pasting them in full into an external service goes the opposite way. Company data (contracts, figures, strategies) are not protected by the GDPR, but once they are out you no longer control them. In both cases the answer is not to stop using AI, it is to stop giving it what it does not need.

Why chatbots make the difference practical

A text you paste into a chatbot leaves your control. It is transmitted, processed, often stored, and depending on the service and its settings it may also end up among the data used to improve the models. That models can retain what they see is not a conference hypothesis. In 2021 Nicholas Carlini and colleagues extracted from GPT-2 hundreds of sequences of its training text word for word, including names, phone numbers and email addresses, even when they appeared in a single document.

The useful rule, then, is simple. The model needs the structure of your text (what happened, in what order, in what tone) and almost never the identity of the people. If you ask it to rewrite a letter to "Person 1" in a more formal way, the result is the same as with the real name, and you put the name back afterwards.

The Anonimizzatore IA, how it works and how much time it saves you

Everything described so far can be done by hand. But if you do it every day, on minutes, reports and emails, it becomes long work and easy to get wrong. That is why we at Retoria distribute the Anonimizzatore IA (AI Anonymiser) free of charge, an open source app for Mac and Windows conceived by Kristjan Prenga. It is called that because its job is to anonymise texts, that is to hide the identity of the people they mention, and to do so it uses pseudonymisation with placeholders. Data recognition happens on your computer, and your documents stay there.

It works in three steps. You upload or record the material, and the app recognises names, tax numbers, IBANs, addresses and other types of personal data (more than twenty in all) and replaces them with placeholders such as [FULLNAME_1] or [CITY_1]. You copy the anonymised text into the chatbot you prefer (ChatGPT, Claude, Gemini) and ask it for what you need. Then you paste the answer into the app and, with the reverse bridge, real names and data go back in place. The correspondence table stays on your computer.

What it can do, with video tutorials

For each function there is a short video showing how to use it (the videos are in Italian).

  • PDF documents. Contracts, resolutions, circulars, reports. The app finds the personal data in the text and replaces them. Watch the tutorial
  • Scans and paper documents. OCR reads scanned pages on your computer, extracts the text and anonymises it. Watch the tutorial
  • Images and screenshots. A photo of a page, a whiteboard or a chat becomes clean text, ready to copy. Watch the tutorial
  • Audio files. Recordings of meetings, interviews or lessons (MP3, WAV, M4A) transcribed and anonymised locally. Watch the tutorial
  • Live recording. You record from the microphone during a meeting and, when you stop, the app transcribes and anonymises what was said. Watch the tutorial
  • Reverse bridge. You paste the AI's answer and the app puts the real names and data back in place, so you get the final document straight away. Watch the tutorial

Texts and digital PDFs work straight away, without registering. Scans, images, audio and recording need the free activation code you get by registering on retoria.it.

How much time it saves, the numbers from a practical test

In one of our training workshops 14 participants anonymised the same text of about one page, first by hand and then with the app, timing each step and rating the result. Here are the central values (the medians).

By hand it took about three and a half minutes, with 14 pieces of personal data found and a quality rated 7.5 out of 10. The app did the same work in 33 seconds and found 17, with a quality of 8 out of 10 before any correction. After a review of about two and a half minutes, the final text reached 9.5 out of 10.

Two bar charts, on the left how much personal data was found by hand and with the app, on the right the quality of the result by hand, with the app before review and with the app after review The same text anonymised by hand and with the Anonimizzatore IA. Median values for 14 participants, quality rated by the participants themselves. Source Retoria, exercise in a training workshop (2026).

On such a short text, in other words, the total time including review is similar to working by hand, but the result is far more complete and safer. The most frequent correction, reported by 11 participants out of 14, concerned indirect identifiers, those details without a name that only someone who knows the context can recognise. That is why your final read remains essential, and why the best quality comes from the app and the person working together.

A concrete example, the minutes of a meeting

The real time saving shows when anonymisation is one step of a longer task. Think of a one hour meeting. The usual way, you take notes while others speak, then tidy them up, write the minutes and read them over. All in all that easily takes a couple of hours.

With the app you record the meeting (or upload the audio file), transcribe it and anonymise it on your computer. You copy the text into the chatbot and ask for minutes with the structure you normally use. You paste the answer into the app and the reverse bridge puts the names back. The work left to you comes down to a few minutes, about five, plus the final read, because the computer does the transcription. And the minutes start from everything that was said, not only from what you managed to write down. The same pattern works for an interview, a report written from voice notes or a reply to a complaint.

And do the chatbot's answers stay good?

It is the objection heard most often, that removing the data makes the AI answer worse. The study Enterprise and personal data protection through anonymization and pseudonymization by Kristjan Prenga, president of Retoria (2025, available through his website), put it to the test on 42 realistic texts, with a prototype that masks the text locally before sending it to a cloud model and then puts the real data back into the answer. Once the names were restored, the answers to texts with placeholders had an average semantic similarity of 92% with those to the original texts, and a second model used as a judge rated them on average 9.67 out of 10 against 9.81, a difference that is not statistically significant. The study also shows that placeholders work better than invented names, because with placeholders the filter found 93.1% of the sensitive data against 84.8%. The work by Stefan Pasch and Min Chul Cha, presented in 2025 at the PrivateNLP workshop, points the same way, masking 97 to 99% of the data in cover letters, emails and personal texts with a quality loss of about one point out of ten. We describe Prenga's study in more detail in the article Anonimizzare prima dell'IA, il gesto che quasi nessuno fa (in Italian).

How to do it tomorrow, in five steps

You do not need a legal department to start. You need a method, and this is the one we recommend.

  1. Ask yourself whether the AI needs to know who it is. Almost always it does not. For a summary, a rewrite or a translation, the identity of the people does not change the result.
  2. Replace direct identifiers with consistent placeholders. Names, tax numbers, IBANs, addresses, emails, phone numbers. Use the same placeholder for the same person throughout the text (Person 1 stays Person 1), otherwise the model gets confused.
  3. Look at indirect identifiers too. A unique role, a precise date, a small place, a rare illness. On their own they seem harmless, together they can be enough. Where you can, generalise, that is write a teacher instead of the German teacher, October instead of 14 October.
  4. Keep the correspondence table out of the prompt. On your computer, separate from the text, never pasted together with the question. It is the difference between protecting data and moving it.
  5. Reread before sending, and put the names back afterwards. No automatic system reaches 100%, as the numbers above show. The final check is yours.

On a short text you can do everything by hand. When it becomes an everyday habit, replacing the data, keeping the correspondence table and restoring the names are done for you by the Anonimizzatore IA, on your computer. Deciding what the AI needs, checking indirect identifiers and reading over the result remain your tasks.

Where to start

Technique fixes the gesture, not the habit. If nobody in your school, organisation or firm knows which data must not leave, not even the best tool is enough. That is why our training programmes always start from real cases and from the rules that people who work with documents every day actually need. Write to us to organise a session with your team, or try the Anonimizzatore IA right away on the first text you would have pasted into a chatbot today. And if you want to understand why this habit already forms at school, read our article on shadow AI.

Methodological note

This article is for information and educational purposes and does not constitute legal advice. For specific decisions, refer to your advisers and to your organisation's Data Protection Officer.

In this article we use "anonymisation" in a broad sense, as the family of processes that hide the identity of people. Pseudonymisation and full anonymisation are its two branches.

Sweeney's figures refer to the United States population and the 1990 census, so they show a mechanism and not a measure valid for any other country today. The 99.98% by Rocher, Hendrickx and de Montjoye is an estimate obtained with a statistical model, not the result of re-identifying a real archive. The data on AI use at work come from a survey (University of Melbourne and KPMG, 48,340 people in 47 countries, collected between November 2024 and January 2025), so they describe what people say they do.

The Anonimizzatore IA times and ratings come from a practical exercise in one of our training workshops (September 2026), carried out with a version of the app earlier than the current 3.0.0. The 14 participants worked on the same text of about 2,800 characters and timed and rated each step themselves. We report the medians. The sample is small and the quality ratings are subjective, so the numbers describe a concrete experience and not a general measure. The minutes example is an indicative scenario and not a measurement, because times depend on the length of the meeting, the computer and how carefully you read over the result.

The results of Kristjan Prenga's study concern a demonstration prototype and not a product in use. Training and testing are based on synthetic data, generated with different models and checked by a person, on 42 texts and six sectors. The comparisons of answer quality rest on six groups per technique, a small number that calls for caution, so the absence of significant differences means the test did not detect a deterioration, not that a deterioration is impossible. The Anonimizzatore IA mentioned in the article is an application different from the study prototype. Surfshark's data come from the privacy labels declared by developers on the App Store, the OmniGPT leak is a claim not confirmed by the platform, and the Samsung case is known from press reports on the company's internal memo.

The guidance of the European data protection authorities and the 2025 judgment of the Court of Justice are summarised in their general points (full references are in the sources) and should be read in full before applying them to a specific case. The European Data Protection Board Guidelines 01/2025 are cited in the version adopted for public consultation.

Sources