{"course":{"slug":"choosing-your-tools","title":"Choosing and Using the Tools","url":"https://addaly.com/learn/choosing-your-tools","level":"beginner","track":"work"},"lesson":{"slug":"reading-terms-in-ten-minutes","title":"Reading the terms in ten minutes","url":"https://addaly.com/learn/choosing-your-tools/reading-terms-in-ten-minutes","position":49,"of":76,"minutes":8,"answer":"Search a privacy policy for train, retention, human review, third part, delete and transfer, read the sentence around each, check whether it covers your tier, and screenshot it with the date.","keyIdea":"Search a privacy policy for train, retention, human review, third part, delete and transfer, read the sentence around each, check whether it covers your tier, and screenshot it with the date, and treat an unfindable answer as the answer."},"body":{"format":"markdown","text":"## You are not going to read all of it\n\nA terms of service plus a privacy policy runs to twenty thousand words of careful drafting, and nobody reads them. The realistic goal is not to read them but to **find the six things that decide whether you can use this tool for the work you do**, which takes ten minutes with a browser's find function.\n\n## The search terms\n\nOpen the privacy policy and search for each of these. Read the sentence around each hit.\n\n**`train`** or **`improve our`**: whether your content is used to develop the models. Note carefully whether the sentence covers your tier. Free and paid consumer tiers are often treated differently from business tiers and from the API.\n\n**`retention`** or **`retain`**: how long content is kept after you send it, and after you delete it. Common answers are 30 days for abuse monitoring, or \"as long as necessary\", which means nothing you can plan around.\n\n**`human review`** or **`reviewers`**: whether people may read samples or flagged content. Almost every service says yes somewhere. It is not sinister; it is how abuse is caught. It does mean the mental model of \"only a machine sees this\" is wrong.\n\n**`third part`**: who else receives your data. Cloud hosts, analytics providers, moderation contractors, payment processors. A good policy lists its sub-processors on a linked page.\n\n**`delete`**: what deletion actually removes, and what survives it. There is nearly always a carve-out for backups, legal obligations and abuse records.\n\n**`transfer`** or a country name: where processing happens. This decides whether your regulator has anything to say about it.\n\n## The three pages that are not the privacy policy\n\n**The trust or security page.** Usually where enterprise commitments live: certifications, sub-processor lists, regional processing options. Frequently says something different from the consumer policy, because it describes a different product.\n\n**The usage policy.** What you are forbidden to do. Worth reading if your work sits anywhere near a restricted category: medical, legal, financial advice, or anything about elections. It binds you, and it is what an account gets suspended for.\n\n> Figure: Six searches, ten minutes. Steps: 1. train, or improve our (Whether your content develops the models, and whether that sentence covers your tier.); 2. retention, or retain (How long it is kept. As long as necessary means nothing you can plan around.); 3. human review, or reviewers (Whether people may read samples or flagged content. Nearly every service says yes somewhere.); 4. third part (Who else receives it. A good policy links a current sub-processor list.); 5. delete (What deletion removes, and the carve-outs for backups, legal obligations and abuse records.); 6. transfer, or a country name (Where processing happens, which decides whether your own regulator has anything to say about it.). Then screenshot the paragraph you relied on with the date visible. If you have told a client their material is not used for training, that screenshot is the only record you will have of what was true when you said it.\n\n**The data controls page inside the product.** Settings, then Data controls or Privacy. Read every toggle, including the ones already switched on, and note which are on by default. This is where the actual switch is; the policy only describes it.\n\n## What \"we do not train on your data\" does not say\n\nIt is a narrow statement and it is worth reading precisely.\n\nIt does not say the data is not stored. It does not say no human will read it. It does not say it will not be sent to a third-party host. It does not say it cannot be produced in response to a legal demand. And it usually does not cover content you have flagged for feedback, or conversations reviewed after a safety trigger.\n\nNone of that makes the statement dishonest. It makes it specific, and the specificity is the point of reading it.\n\n## Where the answer differs by route\n\nOne thing worth checking rather than assuming: the same company frequently applies different terms to its chat product, its API and its business tier. The API is commonly the strictest (no training by default, short retention for abuse monitoring) while the consumer free tier is the loosest.\n\nSo \"does this company train on my data\" is not a well-formed question. The well-formed one names the route: *does this company train on what I send through the free web app, while signed into a personal account, with the default settings*. That is answerable, and the answer often differs from what a headline about the company said.\n\n## The screenshot\n\nTake one, with the date visible, of the settings page and of the paragraph you relied on. Terms change. If you told a client that their material is not used for training, the only record you will have of what was true at the time is the screenshot you took.\n\nFor anything that matters, an archive service that captures a dated copy of a public page is better still, because it is not your own screenshot.\n\n## When the answer cannot be found\n\nIf ten minutes of searching does not produce a clear answer about training, retention and human review, treat that as the answer for anything confidential. Companies that have made a firm commitment say so plainly and near the top, because it is a selling point. Vagueness in this area is rarely accidental.\n\nThat rule alone will do more for your data safety than any amount of technical precaution, because it is applied before the material is sent rather than after."},"check":{"question":"A provider states plainly that it does not train on customer data. What does that sentence leave open?","options":[{"text":"Nothing of consequence, since a commitment not to train implies the data is not retained for any other purpose.","correct":false,"tempting":"Reads a narrow promise as a general one; training and retention are separate practices with separate statements."},{"text":"Whether the data is stored, who may read it, where it is processed, and what a legal demand could compel.","correct":true},{"text":"Only whether the commitment applies retroactively to conversations from before the policy was published.","correct":false,"tempting":"Picks a genuine but minor ambiguity while missing the storage, access and jurisdiction questions the sentence never touches."},{"text":"Whether the model has already memorised earlier inputs, which no current policy can undo once training has occurred.","correct":false,"tempting":"Raises a real limit of past training runs, which is not what this forward-looking sentence is silent about."}]},"prev":{"slug":"who-reads-this","title":"Who reads what you type","url":"https://addaly.com/learn/choosing-your-tools/who-reads-this"},"next":{"slug":"what-a-business-agreement-buys","title":"What a business agreement actually buys","url":"https://addaly.com/learn/choosing-your-tools/what-a-business-agreement-buys"},"authorship":"Founder and series editor: Dr Mustafa Mun. Written by AI models to a written standard. Exam keys checked blind by a second model: 3,665 of 3,666 agreed. Academic review invited.","review":{"status":"Draft, open for academic review"},"cite":"Addaly (2026) 'Reading the terms in ten minutes', in Choosing and Using the Tools. Edited by M. Mun. Addaly. Available at: https://addaly.com/learn/choosing-your-tools/reading-terms-in-ten-minutes (Accessed: 13 October 2026).","licence":{"name":"CC BY-NC-SA 4.0","url":"https://creativecommons.org/licenses/by-nc-sa/4.0/"},"reader":{"schema":1,"title":"Reading the terms in ten minutes","courseTitle":"Choosing and Using the Tools","module":{"index":6,"slug":"data-terms-and-law","title":"Data, terms and the law"},"answer":null,"keyIdea":"Search a privacy policy for train, retention, human review, third part, delete and transfer, read the sentence around each, check whether it covers your tier, and screenshot it with the date, and treat an unfindable answer as the answer.","hero":{"kind":"figure","figure":{"t":"figure","label":"Figure","figure":{"type":"flow","steps":[{"label":"train, or improve our","detail":"Whether your content develops the models, and whether that sentence covers your tier."},{"label":"retention, or retain","detail":"How long it is kept. As long as necessary means nothing you can plan around."},{"label":"human review, or reviewers","detail":"Whether people may read samples or flagged content. Nearly every service says yes somewhere."},{"label":"third part","detail":"Who else receives it. A good policy links a current sub-processor list."},{"label":"delete","detail":"What deletion removes, and the carve-outs for backups, legal obligations and abuse records."},{"label":"transfer, or a country name","detail":"Where processing happens, which decides whether your own regulator has anything to say about it."}],"title":"Six searches, ten minutes","caption":"Then screenshot the paragraph you relied on with the date visible. If you have told a client their material is not used for training, that screenshot is the only record you will have of what was true when you said it."},"alt":"Figure: Six searches, ten minutes. Steps: 1. train, or improve our (Whether your content develops the models, and whether that sentence covers your tier.); 2. retention, or retain (How long it is kept. As long as necessary means nothing you can plan around.); 3. human review, or reviewers (Whether people may read samples or flagged content. Nearly every service says yes somewhere.); 4. third part (Who else receives it. A good policy links a current sub-processor list.); 5. delete (What deletion removes, and the carve-outs for backups, legal obligations and abuse records.); 6. transfer, or a country name (Where processing happens, which decides whether your own regulator has anything to say about it.). Then screenshot the paragraph you relied on with the date visible. If you have told a client their material is not used for training, that screenshot is the only record you will have of what was true when you said it."}},"blocks":[{"t":"h2","id":"you-are-not-going-to-read-all-of-it","runs":[{"text":"You are not going to read all of it"}]},{"t":"p","runs":[{"text":"A terms of service plus a privacy policy runs to twenty thousand words of careful drafting, and nobody reads them. The realistic goal is not to read them but to "},{"text":"find the six things that decide whether you can use this tool for the work you do","b":true},{"text":", which takes ten minutes with a browser’s find function."}]},{"t":"h2","id":"the-search-terms","runs":[{"text":"The search terms"}]},{"t":"p","runs":[{"text":"Open the privacy policy and search for each of these. Read the sentence around each hit."}]},{"t":"p","runs":[{"text":"train","b":true,"code":true},{"text":" or "},{"text":"improve our","b":true,"code":true},{"text":": whether your content is used to develop the models. Note carefully whether the sentence covers your tier. Free and paid consumer tiers are often treated differently from business tiers and from the API."}]},{"t":"p","runs":[{"text":"retention","b":true,"code":true},{"text":" or "},{"text":"retain","b":true,"code":true},{"text":": how long content is kept after you send it, and after you delete it. Common answers are 30 days for abuse monitoring, or “as long as necessary”, which means nothing you can plan around."}]},{"t":"p","runs":[{"text":"human review","b":true,"code":true},{"text":" or "},{"text":"reviewers","b":true,"code":true},{"text":": whether people may read samples or flagged content. Almost every service says yes somewhere. It is not sinister; it is how abuse is caught. It does mean the mental model of “only a machine sees this” is wrong."}]},{"t":"p","runs":[{"text":"third part","b":true,"code":true},{"text":": who else receives your data. Cloud hosts, analytics providers, moderation contractors, payment processors. A good policy lists its sub-processors on a linked page."}]},{"t":"p","runs":[{"text":"delete","b":true,"code":true},{"text":": what deletion actually removes, and what survives it. There is nearly always a carve-out for backups, legal obligations and abuse records."}]},{"t":"p","runs":[{"text":"transfer","b":true,"code":true},{"text":" or a country name: where processing happens. This decides whether your regulator has anything to say about it."}]},{"t":"h2","id":"the-three-pages-that-are-not-the-privacy-policy","runs":[{"text":"The three pages that are not the privacy policy"}]},{"t":"p","runs":[{"text":"The trust or security page.","b":true},{"text":" Usually where enterprise commitments live: certifications, sub-processor lists, regional processing options. Frequently says something different from the consumer policy, because it describes a different product."}]},{"t":"p","runs":[{"text":"The usage policy.","b":true},{"text":" What you are forbidden to do. Worth reading if your work sits anywhere near a restricted category: medical, legal, financial advice, or anything about elections. It binds you, and it is what an account gets suspended for."}]},{"t":"p","runs":[{"text":"The data controls page inside the product.","b":true},{"text":" Settings, then Data controls or Privacy. Read every toggle, including the ones already switched on, and note which are on by default. This is where the actual switch is; the policy only describes it."}]},{"t":"h2","id":"what-we-do-not-train-on-your-data-does-not-say","runs":[{"text":"What “we do not train on your data” does not say"}]},{"t":"p","runs":[{"text":"It is a narrow statement and it is worth reading precisely."}]},{"t":"p","runs":[{"text":"It does not say the data is not stored. It does not say no human will read it. It does not say it will not be sent to a third-party host. It does not say it cannot be produced in response to a legal demand. And it usually does not cover content you have flagged for feedback, or conversations reviewed after a safety trigger."}]},{"t":"p","runs":[{"text":"None of that makes the statement dishonest. It makes it specific, and the specificity is the point of reading it."}]},{"t":"h2","id":"where-the-answer-differs-by-route","runs":[{"text":"Where the answer differs by route"}]},{"t":"p","runs":[{"text":"One thing worth checking rather than assuming: the same company frequently applies different terms to its chat product, its API and its business tier. The API is commonly the strictest (no training by default, short retention for abuse monitoring) while the consumer free tier is the loosest."}]},{"t":"p","runs":[{"text":"So “does this company train on my data” is not a well-formed question. The well-formed one names the route: "},{"text":"does this company train on what I send through the free web app, while signed into a personal account, with the default settings","i":true},{"text":". That is answerable, and the answer often differs from what a headline about the company said."}]},{"t":"h2","id":"the-screenshot","runs":[{"text":"The screenshot"}]},{"t":"p","runs":[{"text":"Take one, with the date visible, of the settings page and of the paragraph you relied on. Terms change. If you told a client that their material is not used for training, the only record you will have of what was true at the time is the screenshot you took."}]},{"t":"p","runs":[{"text":"For anything that matters, an archive service that captures a dated copy of a public page is better still, because it is not your own screenshot."}]},{"t":"h2","id":"when-the-answer-cannot-be-found","runs":[{"text":"When the answer cannot be found"}]},{"t":"p","runs":[{"text":"If ten minutes of searching does not produce a clear answer about training, retention and human review, treat that as the answer for anything confidential. Companies that have made a firm commitment say so plainly and near the top, because it is a selling point. Vagueness in this area is rarely accidental."}]},{"t":"p","runs":[{"text":"That rule alone will do more for your data safety than any amount of technical precaution, because it is applied before the material is sent rather than after."}]}],"check":{"question":[{"text":"A provider states plainly that it does not train on customer data. What does that sentence leave open?"}],"options":[{"text":[{"text":"Nothing of consequence, since a commitment not to train implies the data is not retained for any other purpose."}],"correct":false,"tempting":[{"text":"Reads a narrow promise as a general one; training and retention are separate practices with separate statements."}]},{"text":[{"text":"Whether the data is stored, who may read it, where it is processed, and what a legal demand could compel."}],"correct":true,"tempting":null},{"text":[{"text":"Only whether the commitment applies retroactively to conversations from before the policy was published."}],"correct":false,"tempting":[{"text":"Picks a genuine but minor ambiguity while missing the storage, access and jurisdiction questions the sentence never touches."}]},{"text":[{"text":"Whether the model has already memorised earlier inputs, which no current policy can undo once training has occurred."}],"correct":false,"tempting":[{"text":"Raises a real limit of past training runs, which is not what this forward-looking sentence is silent about."}]}],"order":[2,3,0,1],"why":null},"prev":{"slug":"who-reads-this","title":"Who reads what you type","minutes":8},"next":{"slug":"what-a-business-agreement-buys","title":"What a business agreement actually buys","minutes":8}}}