Every AI tool you use sees what you give it: the document you paste, the photo you upload, the meeting it transcribes. Most of the time that is fine. Sometimes it is not, and the difference is usually written in the vendor's privacy policy and terms, in places few people read. This guide lists what to look for, in plain language, and what to keep out of AI tools whatever the policy says.
This is general guidance, not legal advice. Terms differ between vendors and between plans of the same vendor, and they change, so read the current version for the specific plan you use.
The five questions to answer
Open the tool's privacy policy, terms of service and help centre, and search for the words "train", "retain", "delete" and "third party". You are looking for answers to five questions.
1. Are my inputs used to train the model?
Some vendors use what you type or upload to improve their models, some do not, and many do on free and individual plans but not on business plans. Look for a clear statement either way. If the answer is yes, look for an opt-out, and note whether it is on by default.
2. Can I turn training off, and does it apply to past data?
An opt-out setting usually applies from the moment you turn it on. Check whether it also covers what you uploaded before. Some tools offer a temporary or incognito mode that is not saved to your history; check how long those chats are still kept on the vendor's side.
3. How long are my files and chats kept?
Look for a retention period. "Until you delete your account" and "30 days after deletion" are very different from "as long as necessary". Check whether deleting a chat or file in the app actually deletes it on the server, and how to delete your whole account.
4. Does anyone else see it?
Policies often say data may be shared with "service providers" or "subprocessors", such as cloud hosts, and sometimes with the company that supplies the underlying model. Some vendors also allow staff to review a sample of conversations for safety or quality. Look for which of these apply, and whether reviewed content is anonymised.
5. Where is it stored, and which law applies?
If you or your clients are in a regulated sector, where the data is stored can matter. In India, the Digital Personal Data Protection Act, 2023 gives people rights over their personal data, with its rules being brought into force in phases. If you upload other people's personal data to an AI tool, you are responsible for having a lawful reason to do so.
Free, individual and business plans differ
The same product can have very different terms on different plans. Business and enterprise plans more often promise that your data is not used for training, offer admin controls and shorter retention, and come with a data processing agreement. If your company's or your clients' data is involved, the plan matters as much as the tool.
What not to put into any AI tool
Whatever the policy says, keep these out unless your organisation has approved the specific tool and plan:
- Passwords, API keys and one-time codes.
- Government ID numbers and financial details, such as Aadhaar, PAN, bank account or card numbers.
- Health information about you or anyone else.
- Client or employer documents under an NDA or marked confidential.
- Other people's personal data, such as customer lists or CVs, without a clear reason and permission.
If you need AI help with a sensitive document, remove names and numbers first, or replace them with placeholders, and put them back afterwards.
When a local model is the better choice
For truly private material, the safest option is a model that runs on your own computer, where nothing is sent anywhere. Our comparison of Ollama, LM Studio, GPT4All and AnythingLLM explains how to set one up and what hardware you need. Local models are less capable than the largest cloud models, but for summarising, drafting and searching your own files they are often enough.
A two-minute checklist
- Inputs used for training: yes, no, or opt-out available.
- Opt-out turned on, if one exists.
- Retention period found, and deletion tested.
- Sharing with third parties and human review understood.
- Plan matches the sensitivity of the data.
- Sensitive details removed before uploading.
Related: How to choose an AI tool: 8 checks · Run AI models locally · AI tool free plans explained