Check three things before uploading
What the service says it does with your file: whether it is retained, for how long, and whether it is used for anything beyond producing your result.
Whether the connection is encrypted. Look for HTTPS on every page that handles a file, not just the home page.
Whether you are permitted to upload the document at all. Client contracts and employer policies frequently prohibit it regardless of what the service promises.
Redact before you upload
Remove what the task does not need. To extract line items from an invoice, the bank details are not required.
Redact properly: draw over the text in an editor and flatten the image, or delete it from the source. A black rectangle placed over selectable text in a PDF hides nothing.
Replace identifiers with placeholders when testing. Real names and numbers are rarely necessary to check that a process works.
Sensible defaults
Do not upload identity documents, medical records, or anything containing other people's personal data unless you have a clear basis for doing so.
Do not paste credentials, API keys or private keys into any tool, including code assistants.
Prefer processing that happens in your browser for sensitive material, and understand that anything sent to a server has left your control.
Housekeeping
Delete results you no longer need from your own downloads folder as well as from the service.
Review periodically which services you have uploaded to, and revoke access where an account exists.