A policy adviser drops a forty-page draft report into a chat window and asks for a half-page summary. What they need is the conclusion. What they sent is forty pages, three annexes with names in them and two colleagues' unresolved margin comments.
That gap does not come from carelessness. It comes from an action that looks nothing like what it does.
Step 1: the file leaves your machine
The moment you let go of the file, the whole thing is uploaded to the provider's servers. Not an extract, not a portion: the bytes as they sat on your disk.
This is the point at which the data leaves your organisation. Everything after this happens on the other side of that line.
Step 2: the text layer is extracted
A PDF is not a text file. It is a set of drawing instructions for a page, usually accompanied by a text layer recording which characters sit where.
The service reads that layer. What comes out is not always what you see on screen:
- Text under images. If someone drew a black rectangle over a name, the name is still in the text layer. See why a black box over text is not redaction.
- Footnotes, headers, annexes. Everything in the document, including the parts you had not read.
- Comments and tracked changes. If the document was exported from Word without clearing them first, they come along.
- Metadata. Author name, organisation, creation date, producing software and sometimes the full file path on the machine where the document was created.
Scanned PDFs work differently. With no text layer, the page is an image. Some services apply optical character recognition automatically and process it as text anyway; others report they cannot read it. It is not safe to assume that a scan cannot be read.
Step 3: the text is chunked into the conversation
The extracted text is split into chunks and appended to the conversation. From then on there is no distinction between "text you typed" and "text from a file". It is all conversation text.
Two consequences people rarely anticipate.
First: the contents count against the context window. A forty-page document consumes a substantial share of the available room, leaving less for the exchange that follows.
Second: the contents are re-transmitted with every subsequent turn in that conversation. Ask five follow-up questions and the document is sent to the model five more times.
Step 4: it persists
The uploaded file and the extracted text land in your conversation history. The ordinary rules of the service then apply: retention, the possibility of human review on suspicion of abuse and, on a consumer account, use for training by default.
Many services also retain the original file separately, linked to the conversation, so you can retrieve it later. Deleting the conversation usually takes the file with it, though not always immediately. How those layers behave is covered in our article on what a chat history actually is.
Why there is no such thing as "just summarising"
This is the heart of the misunderstanding, and it is an understandable one.
In your head, summarising is a small task: you are asking for little, so you are giving little. Technically, it is the other way round. To summarise, the model has to see the whole thing. The brevity lives in the output, never in the input.
The same goes for "just pull out the dates" or "check this for contradictions". Small questions about a large document, and the whole document goes.
Compare that with pasting. Paste two paragraphs and two paragraphs travel. That is the only way of working in which you decide what gets sent. When you upload, the file decides.
What to do about it
Three questions, in this order:
- Does the task need the whole document? Often not. A tone check needs one paragraph. Translating the conclusion does not require the annex.
- Does it contain data the task does not need? Names, case numbers, amounts, addresses. Remove them or replace them with a label, keeping the structure intact so the model still follows the text.
- Is what is not on the page accounted for? Metadata, comments, tracked changes. See what stays in a PDF after you remove the text.
Work through those three and you end up uploading fragments rather than case files. That is better for the answer, because the model has less to distract it, and it keeps out exactly the data nobody can later explain having sent.
