Reading the terms in ten minutes

You are not going to read all of it

A terms of service plus a privacy policy runs to twenty thousand words of careful drafting, and nobody reads them. The realistic goal is not to read them but to find the six things that decide whether you can use this tool for the work you do, which takes ten minutes with a browser’s find function.

The search terms

Open the privacy policy and search for each of these. Read the sentence around each hit.

train or improve our: whether your content is used to develop the models. Note carefully whether the sentence covers your tier. Free and paid consumer tiers are often treated differently from business tiers and from the API.

retention or retain: how long content is kept after you send it, and after you delete it. Common answers are 30 days for abuse monitoring, or “as long as necessary”, which means nothing you can plan around.

human review or reviewers: whether people may read samples or flagged content. Almost every service says yes somewhere. It is not sinister; it is how abuse is caught. It does mean the mental model of “only a machine sees this” is wrong.

third part: who else receives your data. Cloud hosts, analytics providers, moderation contractors, payment processors. A good policy lists its sub-processors on a linked page.

delete: what deletion actually removes, and what survives it. There is nearly always a carve-out for backups, legal obligations and abuse records.

transfer or a country name: where processing happens. This decides whether your regulator has anything to say about it.

The three pages that are not the privacy policy

The trust or security page. Usually where enterprise commitments live: certifications, sub-processor lists, regional processing options. Frequently says something different from the consumer policy, because it describes a different product.

The usage policy. What you are forbidden to do. Worth reading if your work sits anywhere near a restricted category: medical, legal, financial advice, or anything about elections. It binds you, and it is what an account gets suspended for.

The data controls page inside the product. Settings, then Data controls or Privacy. Read every toggle, including the ones already switched on, and note which are on by default. This is where the actual switch is; the policy only describes it.

What “we do not train on your data” does not say

It is a narrow statement and it is worth reading precisely.

It does not say the data is not stored. It does not say no human will read it. It does not say it will not be sent to a third-party host. It does not say it cannot be produced in response to a legal demand. And it usually does not cover content you have flagged for feedback, or conversations reviewed after a safety trigger.

None of that makes the statement dishonest. It makes it specific, and the specificity is the point of reading it.

Where the answer differs by route

One thing worth checking rather than assuming: the same company frequently applies different terms to its chat product, its API and its business tier. The API is commonly the strictest (no training by default, short retention for abuse monitoring) while the consumer free tier is the loosest.

So “does this company train on my data” is not a well-formed question. The well-formed one names the route: does this company train on what I send through the free web app, while signed into a personal account, with the default settings. That is answerable, and the answer often differs from what a headline about the company said.

The screenshot

Take one, with the date visible, of the settings page and of the paragraph you relied on. Terms change. If you told a client that their material is not used for training, the only record you will have of what was true at the time is the screenshot you took.

For anything that matters, an archive service that captures a dated copy of a public page is better still, because it is not your own screenshot.

When the answer cannot be found

If ten minutes of searching does not produce a clear answer about training, retention and human review, treat that as the answer for anything confidential. Companies that have made a firm commitment say so plainly and near the top, because it is a selling point. Vagueness in this area is rarely accidental.

That rule alone will do more for your data safety than any amount of technical precaution, because it is applied before the material is sent rather than after.