Data and privacy · Explainer
What happens to the data you send a model
On this page
The short answer
Whether a model provider trains on your data, and how long it keeps it, depends almost entirely on which tier you are using. On business API accounts the major providers commit not to train on customer content, while still retaining it for a period to detect abuse. On consumer and free tiers the bargain can be the opposite, and one vendor tells you in its own terms not to send anything sensitive.
The distinction that matters is not which company. It’s which door you came in through.
What leaves your machine
More than the sentence you typed. A single request carries the system instructions that set the model’s behaviour, the whole conversation so far, definitions of every tool the model can call, the results those tools returned, and any files or images attached.
Two of those are easy to forget. Tool definitions travel on every request, whether or not the model uses them. And tool results mean content your agent fetched from a document store, a ticket system, or a web page is now inside the request too, which is how internal material ends up at a provider without anyone deciding to send it.
Training depends on the tier
| Business or paid API | Consumer or free tier | |
|---|---|---|
| OpenAI | ”As of March 1, 2023, data sent to the OpenAI API is not used to train or improve OpenAI models (unless you explicitly opt in)“ | Separate consumer policies apply |
| Anthropic | Commercial terms state “Anthropic may not train models on Customer Content from Services” | Training is opt-in, and opting in retains de-identified data “for up to 5 years in our model training pipelines” |
| On paid services, “Google doesn’t use your prompts… or responses to improve our products” | On unpaid services, Google “uses the content you submit… to provide, improve, and develop Google products and services and machine learning technologies” |
Google’s is the sharpest case, because both halves are in one document. On the free tier Google also says human reviewers may read, annotate and process what you send and what comes back, after disconnecting it from your account and project, and it gives an unusually direct instruction: “Do not submit sensitive, confidential, or personal information to the Unpaid Services.”
There is a separate ownership question, and it is settled more simply. Anthropic’s commercial terms leave the customer holding all rights to what they send and owning what comes back.
Retention is a different question from training
A provider that does not train on your data still keeps it for a while, and for defensible reasons.
OpenAI keeps abuse-monitoring logs across all API usage for up to 30 days by default, longer where the law requires it, and those logs can contain customer content, including prompts and responses. Zero retention exists and is gated: customers can have content excluded by being approved for Zero Data Retention or Modified Abuse Monitoring, “subject to prior approval by OpenAI and acceptance of additional requirements”, with some endpoints excluded from the controls entirely.
Anthropic’s commercial retention documentation contains the line worth reading twice: “By default, data is retained indefinitely unless a custom retention period is set.” The control is an Enterprise feature, the minimum period is 30 days, and changing the setting deletes anything outside the new window immediately.
On the consumer side the numbers run longer. Deleted conversations leave storage within 30 days, but anything flagged by automated trust and safety systems is kept for up to two years, with the classification scores kept for up to seven.
None of this is unusual or sinister. It is simply a different question from training, with different answers, and the answers are the ones that matter when somebody asks how long a customer’s data lives at a vendor.
Where the processing happens
Google’s paid terms state that data “may be stored transiently or cached in any country in which Google or its agents maintain facilities.” Anthropic sells US-only inference as a priced option carrying a 1.1x multiplier on every token category, which tells you plainly that global routing is the default.
If residency is a requirement rather than a preference, it is a configuration and usually a commercial conversation, not a property you get for free.
What you can control
- Pick the right tier, deliberately. This single choice decides the training question at every provider, and it is the one most often made by whoever signed up first.
- Ask for the retention controls you need. Zero retention and custom retention periods exist, are documented, and generally require approval or an Enterprise plan. Neither is a default.
- Set the retention period rather than inheriting it. Where the default is indefinite, silence is a decision.
- Redact before you send, not after. Once content is in a request it is subject to whatever retention applies. Removing identifiers, secrets and account numbers upstream is the only control that does not depend on a vendor’s policy.
- Look at what your tools are pulling in. Connector and tool output travels in the request. Anthropic’s consumer training policy explicitly scopes raw connector content, including MCP servers, out of training data, which is a reminder that this content is a separate category worth reasoning about.
- Know which requests went where. With several providers and several keys, the answer to “did any customer data reach that model” is a records question rather than a policy question.
- If none of it is acceptable, don’t send it. A self-hosted open-weight model is the only arrangement where the request never leaves, and it costs you the operations.
Common questions
Do model providers train on what I send?+
If they don’t train on it, do they delete it?+
What is zero data retention?+
Does my data stay in my country?+
Is a free tier ever safe for work data?+
What if we can’t send the data anywhere?+
Keep learning