A policy adviser drops a forty-page draft report into a chat window and asks for a half-page summary. What they need is the conclusion. What they sent is forty pages, three annexes with names in them, and two colleagues' unresolved margin comments.
That gap does not come from carelessness. It comes from an action that looks nothing like what it does.
Step 1: the file leaves your machine
The moment you release the file, the complete file uploads to the provider's servers. Not an extract, not a portion: the bytes as they sat on your disk.
This is the point at which the data leaves your organisation. Everything after this happens on the other side of that line.
Step 2: the text layer is extracted
A PDF is not a text file. It is a set of drawing instructions for a page, usually accompanied by a text layer recording which characters sit where.
The service reads that layer. What comes out is not always what you see on screen:
- Text under images. If someone drew a black rectangle over a name, the name is still in the text layer. See why a black box over text is not redaction.
- Footnotes, headers, annexes. Everything in the document, including the parts you had not read.
- Comments and tracked changes. Exported from Word without clearing them first, they come along.
- Metadata. Author name, organisation, creation date, producing software, and sometimes the full path of the machine the document was authored on.
Scanned PDFs work differently. With no text layer, the page is an image. Some services apply optical character recognition automatically and process it as text anyway; others report they cannot read it. Treating a scan as inherently unreadable is not a safe assumption.
Step 3: the text is chunked into the conversation
The extracted text is split into chunks and appended to the conversation. From then on there is no distinction between "text you typed" and "text from a file". It is all conversation text.
Two consequences people rarely anticipate.
First: the contents count against the context window. A forty-page document consumes a substantial share of the available room, leaving less for the exchange that follows.
Second: the contents are re-transmitted with every subsequent turn in that conversation. Ask five follow-up questions and the document is sent to the model five more times.
Step 4: it persists
The uploaded file and the extracted text land in your conversation history. The ordinary rules of the service then apply: retention, the possibility of human review on suspicion of abuse, and on a consumer account, use for training by default.
Many services also retain the original file separately, linked to the conversation, so you can retrieve it later. Deleting the conversation usually takes the file with it, though not always immediately. How those layers behave is covered in what a chat history actually is.
Why "just summarising" is not a thing
This is the heart of the misunderstanding, and it is an understandable one.
In your head, summarising is a small task: you are asking for little, so you are giving little. Technically it inverts. To summarise, the model has to see the whole thing. The brevity lives in the output, never in the input.
The same holds for "just pull out the dates" or "check this for contradictions". Small questions about a large document, and the whole document goes.
Compare that with pasting. Paste two paragraphs and two paragraphs travel. That is the only arrangement in which you determine what gets sent. On upload, the file determines it.
What to do about it
Three questions, in this order:
- Does the task need the whole document? Often not. A tone check needs one paragraph. Translating the conclusion does not require the annex.
- Does it contain data the task does not need? Names, case numbers, amounts, addresses. Remove them or replace them with a label, keeping the structure intact so the model still follows the text.
- Is what is not on the page accounted for? Metadata, comments, tracked changes. See what stays in a PDF after you remove the text.
Work through those three and you end up uploading fragments rather than case files. Better for the answer, because the model has less to be distracted by, and it removes precisely the data nobody can later explain sending.
