The AI never met Anna. Your reply still sounds like you know her.

This is how many tools would send this mail to an AI.

Everything in it: the sender, the account number, the access code, the reason she is away. Keep scrolling and the filters take it apart, one stage at a time.

Strips HTML and tracking pixels, quoted older mails, the signature under the closing line and legal footers. Attachments become their type, without the file name.

The signature with firm, address and mail address and the quoted mail go. The PDF becomes “Attachment: PDF”.

Passwords, one-time codes, login links, IBANs, card numbers and API keys become their type. The value never comes back; the AI never needs it.

The access code becomes [Access code], the IBAN becomes [Account number].

Names, mail addresses, phone numbers and firms become a placeholder with a role, the same one throughout a request.

Anna becomes [Person A · your tax advisor · first-name terms], Thomas becomes [you], and her number and mail address become placeholders too.

Exact amounts and full dates become a ballpark or a relative day, as coarse as the task allows.

€4,380.00 becomes “approx. €4,400”, Oct 15, 2026 becomes “Thursday, in 8 days”, Oct 20, 2026 becomes “Tuesday, in 13 days”.

Health, faith, politics, private debt and legal disputes become a neutral description, from a fixed list of terms.

The knee surgery becomes [health reason].

Each task gets only as much of the message as it needs. Ranking a mail sees its first two sentences, a draft the whole cleaned message.

For a draft the cleaned message stays whole. For ranking, only the first two sentences would go out.

A last, independent scan for mail addresses, account and card numbers and phone numbers before anything leaves. Anything the stages missed is masked.

The scan finds nothing left. Only now does the text go to the model.