This is documented in our Terms of Service (see here) and our Privacy Policy (see here), and your business is welcome to use these.
But what does it
mean practically?
Only your business has access to their inbox and the PII (e.g. resumes, names, addresses etc.) of their clients.
This should be no different than receiving PII information from any other communication channel such as email.
It’s better than SMS as it’s encrypted end to end (client to business Inbox).
The business must ensure proper procedures for access to the information, so client PII information can be protected.