How do you keep users' personal data out of a third-party model API?

Detect it in the assembled prompt, including retrieved passages and tool results, then block or mask it with placeholders, keeping a reverse map to restore values in the reply. It isn't airtight: detectors miss things, and the model can't use what it can't see.