Here’s a common data handling scenario. Open your favorite AI tool, upload a spreadsheet, and request a summary. Not much thought given to AI privacy.
A few seconds later, a clean summary appears, and you move on to the rest of your work without really considering the deeper processes at play.
Here’s what actually happened. You sent company data to a software service running on someone else’s infrastructure. That service received your data, processed it, and generated a response before a single word came back to you.
Now the interesting questions begin regarding AI privacy. Where was that spreadsheet stored? For how long? Is it used to train the AI? Can anyone outside your company access or read that data? If you delete the chat, does the file disappear too? Would any of these answers change if you’d been using a paid account instead of a personal one?
Questions around privacy and risk of data exposure sometimes get collapsed into a single one: “Does the AI train on my data?”
That’s a question worth exploring, but the analysis should run deeper. Training, processing, storage, retention, access, security, and deletion are all different spokes on the same risk hub. To understand the privacy of AI chat, you have to follow your data through its entire lifecycle.
I’m writing a series aims to follow the lifecycle of data submitted to an AI chat. Many of the articles focus on the two AI assistants a general audience is most likely to use: ChatGPT and Claude. That’s because both publish substantial documentation that allows us to examine their stated data-handling practices in detail.
Google’s Gemini and Microsoft’s Copilot follow a similar overall structure. Conversation history is retained and users can opt out of model training, but the details differ: Gemini can retain human-reviewed chats for up to three years even after you delete them (Google, 2026), while consumer Copilot stores chat history for 18 months and trains on signed-in users’ conversations by default unless they opt out (Microsoft, 2026a; Microsoft, 2026b).
Prompts are data
Here’s another use case. An email from an irate customer lands on your desk. You paste the full email text into the AI chat and ask for a short, courteous reply.
Is this just a request for writing help?
Not by a long shot. Technically, you have submitted customer and company information to an AI service. That information might contain names, email addresses, order numbers, financial details, or other identifying specifics buried in the customer’s message, or even the prompt you saved to streamline replies.
What happens to that information the moment it reaches the AI service’s servers?
Information leaves your device and raises AI privacy concerns
For a typical cloud-based AI assistant, the model isn’t running on your device. Your request travels to the provider’s infrastructure, where it’s processed and answered.
That means the first privacy boundary is crossed as soon as you send the text (or files) in the chat. The question stops being, “What am I giving the AI?” and becomes “What am I giving the company that operates the AI service?”
You may trust the quality of the model’s output. But your privacy depends on something else entirely. It’s dependent upon the provider’s policies, technical architecture, contractual terms, retention practices, and security controls.
By framing the AI chat experience in this way, the world of risk becomes considerably bigger and murkier.
The service processes the request
Here’s where we need to get clear on terms. Processing your data is not the same as training a model on it. An AI service can read your prompt, run it through a model, and return a response without ever using the prompt to build a newer version of the AI model.
Suppose you paste in a confidential paragraph from a draft contract and you’ve switched off the toggle that allows the AI service to use your chats for training. You’re protected, right? Well, sort of.
Training off does not mean, by itself, the information in the chat was never:
- stored
- logged
- screened by a safety system
- retained for a set period, or
- sent to another service that helps deliver the feature.
“Not used for training” answers one question and leaves the rest open.
The AI generates a response
The model produces its output. Let’s say a polished version of that customer reply.
Notice that there are now two pieces of conversational data, not one: your input and the AI’s output. Privacy considerations don’t stop at the words you typed. The response itself might contain information derived from the prompt, and depending on the product, account type, and settings, both halves of the exchange may become part of a stored conversation history.
The conversation may be stored
If an AI service lets you close the browser and come back later to find your past chats waiting, that tells you something: at least some representation of those conversations has been stored somewhere. Visible chat history is an obvious form of storage, but not the only signal.
Think about this, “What does store mean here?”
It could mean the conversation you see in the interface, a database record behind it, an uploaded file held separately, security logs, feedback you submitted, backups, or records kept for legal reasons. Each of those categories can have its own retention period. That is why deletion turns out to be more complicated than it looks.
Safety processing is separate from training
AI providers should run their services safely. That means interactions might pass through systems designed to detect abuse, fraud, or attacks. This is a distinct category of processing, and it’s the reason two statements that sound contradictory can both be true at once.
A provider can honestly say it does not use your conversations to train its models and still have automated systems that screen those same conversations for harmful content.
They are independent facts. An AI service can make the first promise while still doing the second. Anthropic, for instance, describes an arrangement like this for its designated covered models: by default no staff can read your retained conversations, but content flagged by automated trust-and-safety systems can be routed to a small set of approved reviewers, with every access recorded in a tamper-proof log (Anthropic, 2026c).
People may have access under specific conditions
Can a human read your conversation? The honest answer isn’t a flat yes or no. It’s “under defined circumstances.” Providers typically have procedures governing when authorized personnel can access data for security, abuse investigation, support, or legal compliance.
Enterprise settings add another layer. If you use AI through your employer, the organization administering that system may have its own access and administrative controls on top of the provider’s. So the parties who could conceivably be involved look less like a two-way exchange and more like a chain:
You
↓
Your organization (if applicable)
↓
The AI provider
↓
Service providers / subprocessors (where applicable)
The exact shape depends on the product. That’s why useful privacy analysis has to look at a specific service rather than making blanket claims about “AI.”
Your data has a retention period
How long does the data stick around? Retention is, once again, a separate question from training. A provider might never train on your conversation yet still keep it for a while to operate the service or meet a legal obligation.
Both of our focus providers publish concrete numbers here, which is what makes them useful anchors for this series.
- When you delete a Claude conversation, Anthropic says it’s removed from your history immediately and deleted from its back-end systems within 30 days (Anthropic, 2026a).
- OpenAI describes the same window for ChatGPT: a deleted chat is scheduled for permanent deletion within 30 days, with exceptions for data that’s already been de-identified or that the company is legally required to keep (OpenAI, 2026a).
Those windows can shift depending on the plan, your settings, whether a conversation was flagged, whether you submitted feedback, and legal requirements. If you turn on Claude’s setting to help improve the model, Anthropic says it may retain that data in de-identified form for up to five years, and only for new or resumed chats after you turn the setting on (Anthropic, 2026a). That is a reminder that “not retained long” and “not used for training” are different settings governed by different rules.
What delete means
When you click Delete, the conversation vanishes from your view. That’s real, and it matters. But it’s not the same event as every copy of the data ceasing to exist everywhere at once.
Deletion can touch several systems on different schedules: the visible conversation, backend records, uploaded files, logs, backups, and legally retained data. Two features make this vivid.
ChatGPT’s saved memories are stored separately from your chat history. Delete the conversation and the memory it produced can persist until you clear it manually (OpenAI, 2026b).
And in 2025, a court order in the New York Times’ lawsuit against OpenAI required the company to preserve output logs that would otherwise have been deleted, including conversations users had already tried to remove (Wang, 2025; OpenAI, 2025b). Deletion was real, but for a time it was neither instant nor fully within the user’s control.
None of this implies wrongdoing. Distributed software systems genuinely have multiple layers of storage and legitimate retention requirements. But it does mean “I deleted the chat” and “every copy of that information is gone” are not the same statement.
What about files?
A file raises its own set of questions: Where is it stored? Is it tied to the conversation or held separately? How long is it kept? Does deleting the chat delete the file? Is it subject to model-improvement settings? Can administrators reach it? These are product-specific, and the answers can surprise you.
OpenAI, for example, treats files saved to its Library separately from chats. That means deleting a conversation does not necessarily delete a file you saved from it (OpenAI, 2026a). We’ll take files apart in detail later in the series.
The questions worth asking
The next time someone reassures you with “Don’t worry, they don’t train on your data,” you’ll know that’s one answer to one question. The fuller list looks like this:
- What data do they collect, and what do they process?
- What’s stored, and for how long? Who can access it, and under what conditions?
- What’s used for model improvement versus safety?
- What happens when you delete it—across every system, not just your screen?
- Where is the data processed, and does anyone outside the company receive it?
- Are the answers different for free, paid, business, and enterprise users?
Conceptually, the journey from Send to deletion looks like this:
You type or upload information
↓
Your device sends it to the AI service
↓
The service processes the request
↓
The model generates a response
↓
The interaction may be stored, logged, or screened for safety
↓
The conversation and any files may be retained according to the product's policies
↓
The data is eventually deleted or de-identified per the retention rules
Sources
A note on sources: provider policies cited here were current as of August 2026. Because these policies change quickly (Anthropic revised its consumer privacy policy in 2026, and OpenAI’s retention practices shifted around active litigation) check the linked sources for the latest wording before relying on any specific figure.
References
Anthropic. (2026a). How long do you store my data? Anthropic Privacy Center. https://privacy.claude.com/en/articles/10023548-how-long-do-you-store-my-data
Anthropic. (2026c). Data retention practices for Covered Models. Anthropic Privacy Center / Claude Help Center. https://privacy.claude.com/en/articles/15425996-data-retention-practices-for-covered-models
Google. (2026). Gemini Apps Privacy Hub. Gemini Apps Help. https://support.google.com/gemini/answer/13594961
OpenAI. (2025b). How we’re responding to The New York Times’ data demands in order to protect user privacy. https://openai.com/index/response-to-nyt-data-demands/
OpenAI. (2026a). Chat and File Retention Policies in ChatGPT. OpenAI Help Center. https://help.openai.com/en/articles/8983778-chat-and-file-retention-policies-in-chatgpt
OpenAI. (2026b). Memory FAQ. OpenAI Help Center. https://help.openai.com/en/articles/8590148-memory-faq
Microsoft. (2026). Privacy FAQ for Microsoft Copilot. https://support.microsoft.com/en-us/microsoft-copilot/privacy-faq-for-microsoft-copilot ; Microsoft. (2026). Microsoft Copilot privacy controls. https://support.microsoft.com/en-us/microsoft-copilot/microsoft-copilot-privacy-controls
Wang, O. T. (2025). Order (Preservation), In re: OpenAI, Inc. Copyright Infringement Litigation, No. 25-md-3143 (SHS)(OTW) [Court order, May 13, 2025]. U.S. District Court, S.D.N.Y. https://cdn.arstechnica.net/wp-content/uploads/2025/06/NYT-v-OpenAI-Preservation-Order-5-13-25.pdf