Tom Mulholland works sixty-five hours a week at his grocery store, and Meta picked him as the face of its small-business pitch: “There are so many things where I’m the only one who can do them,” he said in the September 29 announcement. Meta’s offer was simple. Connect Muse to QuickBooks, Stripe, Shopify, Klaviyo and Slack, and let the agent read the books, flag the odd expenses, draft the ads. Nobody at the launch mentioned the second document, which had taken effect twelve days earlier.
Muse for Small Business adds fifteen third-party connectors to the personal agent Meta launched September 8: Asana, Box, Canva, Dropbox, Figma, Granola, HighLevel, Intuit QuickBooks, Klaviyo, Lovable, Notion, Shopify, Slack, Stripe and Zoom, alongside Facebook Pages, Instagram professional analytics and Meta ad accounts, Reuters reported. Meta’s suggested prompts tell the story plainly: analyze a year of sales and campaigns and write a growth plan; review this month’s books and find the expenses that look off. Nothing publishes, sends or spends without the owner’s approval, which is the safeguard every outlet repeated, along with pricing Meta never confirmed.
Effective September 17, the Muse Privacy Policy is a short document that deserves a full reading, and its shortest sentence does the most work: “This setting is on when you first use Muse.” The setting governs whether your interactions train Meta’s models. Turning it off takes three taps, Settings, Data controls, toggle, which is at least honest.
Then the sentence most owners will never read, quoted in full: “Your interactions with Muse can also include information from services Muse uses to perform tasks for you, including Connectors. The same toggle in your Settings controls whether that information can be used to improve AI at Meta.” Read it again slowly: the books, the customer list, the payroll run, all training-eligible by default the moment the data flows.
Meta spells out the removal list in a single sentence: it strips “certain categories of personally identifiable information like names, email addresses, phone numbers and Social Security Numbers,” then disassociates the rest from your account, four named categories in total. Now inventory what a QuickBooks connection actually carries: customer purchase histories, revenue and margin figures, vendor bank routing and account numbers, employee salary amounts, client addresses; then strike the ones Meta names and you keep names, emails and phones; your margins, your vendor’s bank account, and what each customer bought and how often appear nowhere in that sentence. “Like” keeps the list open, which means it can be longer than stated, though it can also be exactly as short as written, so assume the short version.
Retroactivity is the one part stated with admirable clarity: “Changes to this setting also apply to previous interactions.” What the policy never says is what happens to a model already trained on your data. Nothing in the document promises extraction from trained weights, because no company currently does that cleanly, and once the model has seen your margins the toggle is a door closing after the truck left.
Then there is the person who never clicked anything: you connect your QuickBooks, but your customers didn’t, your employees didn’t, your vendors didn’t, since its language is “your interactions” while a business owner’s interactions are made of other people’s information. Consent travels exactly one person deep, and the policy has nothing to say about the other two. The other two never signed up.
Meta’s counter deserves a fair hearing at full strength. Tarek Sheasha, the vice president running Meta Superintelligence Labs, told WIRED the default is deliberate: every user gets a better agent because all users collectively teach it “the intricacies of human life.” He is right that the improvement is real, and a small business would be among the beneficiaries. Meta also walls conversations and VM data off from its ad systems, even inside a shared Accounts Center, a structural separation most of its history wouldn’t have offered, while Sentinel and the approval gates mean the agent cannot publish, send or spend without the owner. Judge it against the status quo, not against a perfectly private agent that does not exist: the sixty-five-hour week, the spreadsheet emailed to a personal address, the passwords in a shared notebook, the employee who copies the customer list to a personal phone on the way out. An agent with an audit trail beats a sticky note, but only if you set the gates before the data flows, which is what makes the promised end state matter: the Confidential VM, “an environment we’re designing to keep people’s information private, even from Meta.” Note the tense. Designing, not designed. It has not shipped. Until it does, the guarantee is a set of policies Meta enforces on itself, not encryption you hold.
Five moves, in order, and the first happens before you connect anything
- Flip the training toggle first. Settings, Data controls, “Help improve our AI models,” off, because connector data becomes training-eligible the moment it flows and there is no documented path out of an already-trained model.
- Keep Muse out of your personal Accounts Center. Sign up with a separate email, since the policy allows combining information across profiles in one Accounts Center and separation is a one-time choice at signup.
- Connect the narrowest scope first. Use read-only connector modes where offered, and wire up analytics and sales summaries before payroll and vendor banking, because the agent does not need your routing numbers to find an odd expense.
- Treat the connection as a disclosure to a third party. Your customers and employees never consented, so read your contracts, your state’s privacy law and your professional ethics rules as if you just emailed the data to a vendor, because functionally you did.
- Audit what the agent remembers, and believe the verbs. Ask Muse what it recalls about you and use the Forget skill for specific topics. The policy’s own phrasing is that Muse will forget “to the best of its ability,” and that after you delete something, Muse may still “remember” information it learned from what you deleted. Those are the most honest sentences in the document.
What this article did not prove
Here is the honest accounting. I could not independently verify Meta’s sanitization process or confirm what “certain categories” covers beyond the four named in the policy, so the gap analysis rests on the text as written, not on an audit of the pipeline. Nobody outside Meta can say which fields cross the wire in practice, because the OAuth scopes the QuickBooks and Stripe connectors request are not published in any source I found, and I did not test the Data controls toggle in the live app, while the subscription pricing reported by one outlet is unconfirmed by Meta. Six weeks in, no independent review of the training pipeline exists, and the Confidential VM has no public ship date beyond “we’re designing.”
The relief is real. So is the default. Check the toggle before you connect the books.