The privacy price of free AI: what happens to what you type

A question I get in every training session: is my data used to train the model?

The answer is neither yes nor no. It is: it depends on your account type, and that difference matters more than which provider you chose.

The general pattern across most providers#

This is a general pattern rather than a verdict on any provider, and policies change. Open the policy page for the tool you personally use today, because what was true six months ago may not be now.

What people do not worry about enough#

Everyone asks about training. Few ask about the more consequential parts.

Retention. Even where your data is not used for training, it is stored for a period. Any storage is an attack surface, and any future breach exposes what was stored.

Human review. Many services allow staff to review samples for safety and service quality. This is disclosed in the policies and rarely read.

Plugins and intermediaries. A tool you layer on top of another tool may pass your text to a third party whose policy you never read. This is the most common leak point I see in organisations.

The one rule that protects your organisation#

Instead of a twenty page policy nobody reads:

That single sentence covers, in practice, most of what long policies cover, and any employee can apply it with no training.

For those wanting specifics, here is what never gets pasted into a free tool: identifiable customer data, unsigned contracts or negotiated pricing, personal health or financial data, code containing keys or secrets, and anything carrying a confidentiality classification.

What if the data must not leave at all?#

Then policy does not solve it and you need different architecture: an open model running inside your own infrastructure, or a cloud service under a contract specifying where processing happens geographically.

In regulated sectors this is not a luxury. It is an entry condition.

The honest part#

I am not someone who says do not use free tools. They are excellent for most of what we do, and banning them produces what practitioners call shadow IT: staff using them from personal accounts with no oversight at all, which is far worse than organised use.

The balanced position: free tools for general work, organisational tools for sensitive data, and one rule everyone understands separating them.

I have written a shorter, more detailed comparison of provider policies in the free resources on this site, designed to be printed and handed to a team.

In closing#

"Free" in this industry does not mean without cost. It means the cost is not money. That is entirely acceptable, as long as you know what you are paying.

Start with five minutes today: open the privacy settings of the tool you use daily and read what it says about training and retention. Most people have never opened that page.

Common questions#

Are my conversations used to train models?

It depends on your account type more than on the provider. Free accounts may be used by default; business accounts and APIs usually are not. Open your tool's policy page today, because policies change.

What is the difference between a free and a business account?

A business account sells you a contractual commitment that your data will not be used for improvement, with guarantees about retention and processing. You are buying an undertaking rather than extra features.

Which risk do people overlook?

Plugins and intermediaries. A tool layered on another may pass your text to a third party whose policy you never read, and that is the most common leak point in organisations.

What is the simplest usage policy for a team?

One sentence: do not type anything into an AI tool that you would not accept seeing in a public report with your name on it a year from now. It covers in practice what long policies cover, with no training needed.

What if my data cannot leave the organisation?

Policy alone is insufficient and you need different architecture: an open model inside your infrastructure, or a service under a contract specifying processing location. In regulated sectors that is an entry condition rather than a choice.