Where your words go

Three things happen to a message

When you type into a chatbot, three separate things can happen to the text, and the product’s terms decide each one independently.

It is stored, on the company’s servers, usually indefinitely unless you delete it, and for a period after you do. It may be reviewed by a person: the companies sample conversations for quality and safety, and contractors read the samples. And it may be used for training: included in the material the next model learns from, which means, in principle, that a specific enough phrase from your conversation could surface in someone else’s answer.

The three are not the same, and a product can do any combination. Start by finding out which.

What the defaults are

The pattern across the main consumer products, as of 2025, is this. Free and personal subscriptions are used for training by default, and there is a setting that turns it off, typically under data controls, with a name like “improve the model for everyone”. Business and enterprise tiers are not used for training by default, because companies would not buy them otherwise. Programmatic access through an API is not used for training by default either. Some products offer a temporary conversation that is excluded from training and deleted after a short period, typically thirty days.

Two products’ notices are worth quoting in spirit. One states plainly that conversations reviewed by a human may be kept for up to three years, and asks you not to enter confidential information. Another changed its default in 2025 so that consumer conversations are used for training unless the user opts out, with retention of several years for those who do not. The defaults move, and the direction they have moved is toward more use, not less. Check yours this month, not once.

The cases that made the rules

In April 2023 engineers at a large electronics company pasted proprietary source code and an internal meeting transcript into a chatbot to fix bugs and write a summary. The company banned the tools weeks later. Nothing malicious happened; the text was now on another company’s servers, under that company’s terms.

In March 2023 Italy’s data-protection authority blocked the leading chatbot in the country for a month over how it collected and used personal data and whether children could use it. The service came back with an age check and the opt-out setting that everyone now has. The setting exists because a regulator required it.

And in 2025 a United States court, in a copyright case, ordered the same company to preserve its users’ conversation logs (including ones users had deleted) as potential evidence. The order was contested and later narrowed, but for a period “delete” meant “hidden from you and retained for the court”. That is the asterisk: a deletion is a promise by a company, and a promise can be overridden by a legal process that has nothing to do with you.

What to do, in order of effort

Strip what does not need to be there. Names, account numbers, addresses, the client’s name, the patient’s initials. The model does not need them to rewrite the paragraph, and the paragraph is what you want.

Turn off training on your account, and use the temporary mode for anything you would not want read by a contractor.

For work, use the tier your employer pays for, where the contract says no training and no human review. If your employer has no policy, the honest position is that anything you paste is disclosed to a third party, and you should treat it as you would treat emailing it to them.

For the sensitive (medical, legal, financial, other people’s data) use a model on your own machine. The lesson two on from this shows how, and the reason is simple: text that never leaves your laptop is not stored, reviewed or trained on by anyone.

What this does not cover

The assistant built into your email, your documents or your phone has different rules again, and a later lesson in this module is about it. And none of the above applies to the content of what the model tells you. If a colleague’s medical condition comes back in an answer because it was in the training set, that was someone else’s disclosure. The setting on your account protects the next person from yours.