Buyer registers and AI data leakage: what a buyer spreadsheet gives away in ChatGPT or Claude.

Every sales agent keeps a buyer register: who has enquired, what they want, what they can spend and whether their finance is ready. It is the most valuable list in the agency, and it is a spreadsheet, so it is easy to upload to ChatGPT or Claude to match buyers to a new listing or draft a round of follow-up messages. The sheet holds names, mobiles and email addresses against budgets, lender status, deposit sources and a notes column that records separations, illness and family money. This page marks what a routine buyer register exposes and shows how the same list is worked on Ermos inside the agency.

The buyer register spreadsheet

Kept by each sales agent from enquiries, open homes and calls, to match buyers to listings and to decide who to ring first when a property comes on.

fx=COUNTIF(E2:E11,">=1900000")⁷

	A	B	C	D	E	F	G	H	I
1	Buyer	Mobile	Email	Looking for	Budget	Finance	Source	Last contact	Notes
2	Andrew and Sophie Lindqvist¹	04xx xxx 301²	andrew.lindqvist@example.com²	Summer Hill house, 3 to 4 bed³	1,900,000⁴	Pre-approved. Marrickville unit sold.⁵	Open home 17 Oct	29/10/2026	Offered 1,865,000 then 1,890,000. Baby due December.⁶
3	Tariq Haddad¹	04xx xxx 302²	t.haddad@example.com²	4 bed, Ashfield or Summer Hill³	2,000,000⁴	Cash once Petersham unit settles 20 Nov⁵	Online enquiry	29/10/2026	Pest report found activity at Elsmere. Cooling.⁶
4	Gavin and Louise Frost¹	04xx xxx 303²	frosts@example.com²	Upsizing, 4 bed³	2,100,000⁴	Must sell first. Pre-approval expired.⁵	Referral	21/10/2026	Louise’s father unwell. Timing uncertain.⁶
5	Min-jung Park¹	04xx xxx 304²	mj.park@example.com²	Investment unit, Lewisham³	1,400,000⁴	Approved. Two existing loans.⁵	Newsletter	24/10/2026	Wants 6/22 Quandong St if Wei Ng sells. Owner has not told tenant.⁶
6	Nadia Rahimi¹	04xx xxx 305²	nadia.rahimi@example.com²	First home, unit or small house³	1,100,000⁴	Savings 140,000. Parents to guarantee. Not applied.⁵	Open home 24 Oct	28/10/2026	Parents Farid and Layla guarantee. Partner not on the loan.⁶
7	Dr James Oyelaran¹	04xx xxx 306²	j.oyelaran@example.com²	House, Haberfield or Summer Hill³	2,400,000⁴	Cash. Lives in Singapore.⁵	Online enquiry	19/10/2026	Sister Funmi will sign. Asked about foreign buyer rules; refer to solicitor.⁶
8	Peter and Ana Svoboda¹	04xx xxx 307²	svobodas@example.com²	Downsizing, 2 to 3 bed³	1,600,000⁴	Pre-approved. Brother lending 200,000.⁵	Letterbox drop	25/10/2026	Separating. Peter wants to buy before the family home settles.⁶
9	Rachel Bloom¹	04xx xxx 308²	rachel.bloom@example.com²	Two-bedroom unit³	1,250,000⁴	Redundancy payout. No finance yet.⁵	Open home 17 Oct	22/10/2026	Property settlement with ex-husband in Court. Keep quiet.⁶
10	Olivia Grant and Ben Nakamura¹	04xx xxx 309²	og.bn@example.com²	Renovator, 3 bed³	1,750,000⁴	Pre-approved⁵	Open home 17 Oct	26/10/2026	Kitchen needs full renovation, they said.⁶
11	Iris Dalgleish¹	04xx xxx 310²	iris.d@example.com²	Large house, off-market³	2,200,000⁴	Self-funded through a family trust⁵	Referral	20/10/2026	Trustee is her brother Colm. Wants no advertising.⁶

Buyers OctVendor matches⁸

An invented buyer register as at 29 October 2026. All people are fictional and the telephone numbers and email addresses are not real. Hover or tap any highlighted item for the analysis; the full list is below.

What leaves the agency

Buyer names

Ten buyers or couples, named. Personal information about people who are prospective customers, and the key to every other column. Privacy Act guide.

Frontier Models (ChatGPT, Claude)	Ten buyers’ names transmitted
Ermos Edge	Stays on your instance in Australia; leaves only inside a permitted excerpt, per question, to the named provider
Ermos Dominion	Stays on the unit in your office

Mobile numbers and email addresses

Direct contact details for every buyer. Personal information, and the starting point for phishing and impersonation. Privacy Act guide.

Frontier Models (ChatGPT, Claude)	Ten buyers’ mobiles and emails transmitted
Ermos Edge	Stays on your instance in Australia; leaves only inside a permitted excerpt, per question, to the named provider
Ermos Dominion	Stays on the unit in your office

What each buyer is looking for

Suburbs, sizes and types. Low risk on its own, though against a named buyer it shows where they are likely to be and what they are planning.

Frontier Models (ChatGPT, Claude)	Search criteria alone are low risk; against names they show plans
Ermos Edge	Stays on your instance in Australia; leaves only inside a permitted excerpt, per question, to the named provider
Ermos Dominion	Stays on the unit in your office

Budgets

The most a buyer says they can spend, which is the figure a vendor or rival would most like to see. Commercial and financial information about each buyer. Privacy Act guide.

Frontier Models (ChatGPT, Claude)	Every buyer’s budget transmitted
Ermos Edge	Stays on your instance in Australia; leaves only inside a permitted excerpt, per question, to the named provider
Ermos Dominion	Stays on the unit in your office

Finance status and sources of funds

Pre-approvals, cash from a sale, a brother’s loan, a parental guarantee and a redundancy payout. Financial information about identifiable people, some of it about third parties. Privacy Act guide.

Frontier Models (ChatGPT, Claude)	Finance and family money transmitted
Ermos Edge	Stays on your instance in Australia; leaves only inside a permitted excerpt, per question, to the named provider
Ermos Dominion	Stays on the unit in your office

The notes column

Free text with the most sensitive detail: a pregnancy, a sick relative, a separation, court proceedings, a trust and a vendor who has not told his tenant he may sell. Health and family information the agency has to be able to keep to itself, and a confidence about another client. Patient data guide.

Frontier Models (ChatGPT, Claude)	Confidences about health, separations and a vendor transmitted
Ermos Edge	Stays on your instance in Australia; leaves only inside a permitted excerpt, per question, to the named provider
Ermos Dominion	Stays on the unit in your office

7
The count formula
A formula that counts budgets at or above a figure. It holds no personal information, and the same formula can be shared safely.

Frontier Models (ChatGPT, Claude)	A formula with no personal data in it
Ermos Edge	Not about where data goes
Ermos Dominion	Not about where data goes

Other tabs, hidden columns and file properties

A spreadsheet file generally carries more than the visible tab: other sheets, hidden columns, cell comments and properties such as the author. A tab that matches buyers to vendors would link the two. Uploading the file sends all of it.

Frontier Models (ChatGPT, Claude)	Every tab, hidden column and comment travels with the file
Ermos Edge	Stays on your instance in Australia; leaves only inside a permitted excerpt, per question, to the named provider
Ermos Dominion	Stays on the unit in your office

What happens in Frontier Models (ChatGPT, Claude)

The whole document is transmitted to the provider’s servers. On personal plans the user cannot choose where it is stored or processed, and for the major providers that has generally meant outside Australia, under that country’s legal process. Some business plans offer storage in Australia, but the provider still receives the content.
On consumer tiers, prompts can be retained and used to train future models.
The provider’s staff and systems can reach the content under the provider’s own policies.
Once sent, the agency no longer controls it. Retention and deletion happen on the provider’s terms.

The same document on Ermos

Ermos Dominion

The document is drafted on a unit in your office, from your own templates and the property file. Every marked item stays on the unit, which keeps working with the internet switched off. Nothing in it is transmitted to an AI provider, so there is no disclosure to analyse: the confidentiality work is the same as for your file server.

Ermos Edge

Your documents, the index and your access boundaries stay on your own instance in an Australian data centre. When a staff member asks for this draft, only their question and the excerpts they are permitted to see go to a named Australian provider, who is contractually barred from keeping the content or training any model on it. Nothing is processed outside Australia.

	Frontier Models (ChatGPT, Claude)	Ermos Edge	Ermos Dominion
Where the document is processed	Provider servers, generally offshore on personal plans	Your instance in an Australian data centre; answers generated in Australia	The unit in your office
Who can read it	Provider staff and systems, under policy	Your staff, within the boundaries you set. The named Australian provider processes only permitted excerpts, under contract, and keeps nothing	Your staff only
Is it kept	On the provider’s terms	Kept on your instance; the provider is barred from retaining it	Stays on the unit
Can it train a model	On consumer tiers, yes	No, by contract	Only your own unit learns from it, on your hardware

Part of AI data leakage in real estate agencies.

Common questions

Do ChatGPT and Claude use the information in a buyer register spreadsheet?

Whatever is pasted or uploaded from the register goes to the AI company's servers and is processed there to produce a reply. As at October 2026, whether a conversation on a personal plan (ChatGPT Free, Plus or Pro; Claude Free, Pro or Max) can be used to train the models depends on a setting each user controls. Business plans (ChatGPT Business and Enterprise, Claude Team and Enterprise) and the developer APIs sit under commercial terms, and OpenAI and Anthropic each say they do not train on that content by default (OpenAI, Anthropic). On either product, the thumbs up and thumbs down buttons can send a whole conversation back for training. The register puts ten buyers' names, mobiles and budgets beside their finance details and a notes column that records a pregnancy, court proceedings and a vendor who has not told his tenant.

Can we use ChatGPT or Claude for a buyer register spreadsheet if we remove the names?

Not safely, because the other columns still describe identifiable people. Removing names rarely makes a document anonymous. Information stays personal information while the person is reasonably identifiable, and the OAIC warns that information can be at risk of re-identification even when it has been de-identified or anonymised. A mobile number, an email address, a budget and a source of funds such as a brother's loan or a family trust each point to one buyer. The Office of the Australian Information Commissioner (OAIC) recommends in its guidance on commercially available AI products that organisations do not enter personal information, and particularly sensitive information, into publicly available generative AI tools, because of the significant and complex privacy risks.

Can I upload a buyer register spreadsheet to ChatGPT or Claude instead of pasting it?

An uploaded register leaves the agency as a whole file, which can carry other sheets, hidden columns, comments, tracked changes and file properties as well as the part you meant to share. The OAIC's guidance also tells organisations to review carefully the terms and settings that will apply to their use of any AI product. Here, a tab that matches buyers to vendors would link the two, and the budgets and the notes column would travel with it.

How can a real estate agency use AI for a buyer register spreadsheet without sending it to ChatGPT or Claude?

Ermos is built so the document stays under your control. On the Dominion AI unit it is drafted inside your office and none of it is sent to an AI provider. On Ermos Edge your documents and index stay on your own instance in an Australian data centre, and only the question and the excerpts the user is permitted to see go to a named Australian provider that is contractually barred from keeping them or training any model on them. The answer is produced from the agency's own buyer records. The sales agent checks every name, budget and note against the register before acting on it.

Is a buyer register personal information?

Yes. Names, mobile numbers, budgets and finance details are all information about identifiable people. Whether the Privacy Act binds a particular agency depends on its turnover and activities: the OAIC says most small businesses with turnover of $3 million or less are outside it, subject to exceptions such as operating a residential tenancy database or trading in personal information. A small agency that is an AML/CTF reporting entity is covered only for its AML/CTF activities.

Why is the notes column the biggest risk in the register?

Because it holds what agents hear in confidence: a pregnancy, a family illness, a separation and a vendor's plans. Those notes are useful for matching buyers to listings, but they are about people who did not expect them to leave the agency, and about another client in the case of a vendor who has not told his tenant.

How much should a buyer register hold at all?

Under Australian Privacy Principle 3, an organisation covered by the Privacy Act must not collect personal information unless it is reasonably necessary for its functions or activities, and generally needs the person's consent to collect sensitive information such as health information. A register that records separations, court proceedings and family money may hold more than matching buyers to listings needs.

See Dominion answering from your own documents.

A demonstration takes 30 minutes, uses no client data, and comes with no obligation.

Book a demo

Keep reading

AI data leakage in real estate agencies Resources The Privacy Act, the APPs and AI All professions