Privacy in AI tools

What happens when you send a prompt

Your text leaves the browser or app over an encrypted connection, is decrypted on the vendor server, handed to the model, and the answer comes back. Nothing unusual so far: this is what every other form on the internet does. The difference starts at the point where that text is not deleted once the answer exists.

The same text has three separate fates, and most privacy arguments go nowhere because they collapse the three into one. First retention: a copy of the conversation stays in your account and in the vendor systems so you can open it tomorrow. Second review: some conversations are read by a person, to measure quality or to check for policy violations. Third training: the text becomes data that the next generation of the model learns from.

Everyone worries about the third one, and the third one is the only one that usually has an off switch. The first two do not, because the service cannot work without them: what was never stored cannot be reopened tomorrow, and a violation nobody looks at is a violation nobody stops.

Deletion is also less final than it sounds. Google own help page for Gemini says that chats already read by human reviewers are not deleted when you delete your activity and are kept for up to three years, because they are no longer connected to your Google Account. It is one sentence and it changes most people mental model.

What each vendor does with your data

The table below was read off each vendor own page, not off second hand summaries. The check date is printed at the top of this lesson and these pages really do change; if you are making a decision today, open the links.

The pattern that falls out of this table is rarely said plainly: the dividing line is not paid versus free, it is the kind of contract. A consumer account is a product, and your data is fuel for improving that product; a business account is a contract, and the other side has made a commitment inside it. That is why the free quota of the Gemini API runs the same model yet its terms tell you not to send confidential information, while the paid quota of the same API says no such thing.

We write no claim here about the ChatGPT consumer plans. The openai.com domain and their data help page return a 403 to this server; the only thing that opens from here is the developer documentation, which speaks about the API alone. You have to read the consumer plan policy in Data Controls inside that account, and we do not quote a sentence we have not read.

What you should never paste

The list is short and does not depend on any vendor settings, because the risk does not come from the training path. Once a text leaves your machine it is on a machine you do not administer.

Keys and passwords. A password, an API key, an access token, a database connection string, the contents of wp-config. If you have already pasted one of these, deleting the conversation does not fix it: that key is burned and has to be rotated. It is the only item on this list whose response is immediate.

Client identity data. National ID numbers, card numbers, home addresses, medical records, a customer list with phone numbers. The issue here is not only your risk; the data belongs to someone who trusted you and did not authorise this transfer.

A document that is not public yet. An unsigned contract, the price draft you are going to hand the client tomorrow, a financial statement, legal text under negotiation.

Organisation code and configuration. A closed employer repository, a server configuration file, firewall rules. There is a fine line here: pasting a twenty line function to debug it is usually fine; pasting the whole repository so that it can see everything is another matter.

The test that works in practice and depends on no policy: if this same text were written on a whiteboard in a cafe and that would upset you, do not paste it. Our position is plain too. The argument about which tool is safer almost always starts too early. First decide what must not leave the machine at all; after that, the choice of tool is a small question.

What policy a small agency should write

An AI privacy policy for a team of five has to fit on one page, or nobody reads it. Five clauses are enough.

One: no shared accounts. A shared account means everyone chat history is in front of everyone, and it means anyone who holds the account email can reset the password and read all of it. If budget is tight, reduce the number of accounts rather than spreading one across several people.

Two: a list of what may go out, not a list of what may not. A forbidden list is always incomplete. An allowed list is short and memorable: public site copy, published content, sample code with no keys, data you produced yourself.

Three: a redaction step before the paste. Client names, numbers, emails and addresses get replaced with labels. This happens on your own machine, not with help from the same model that is about to read the text. The fast path section of this lesson gives a two minute version.

Four: a response to slips, with no punishment. If somebody pastes a key they have to be able to say so without fear, because the thing that must happen immediately is rotating that key. A team that hides slips keeps a burned key on the server.

Five: a review date. The table above will change within six months. Put a date on it and reopen the vendor pages that day.

The clause people leave out is the most important one: decide which account client work runs on. A consumer account for your own work, and for anything holding client data, an account with a contract behind it. That difference is set by the kind of subscription, not by a setting.

From Iran the problem has one more layer

Most of these tools have no official route from Iran. Iran is on neither of Anthropic two supported country lists, and Google own page announces Gemini in more than 230 countries and territories, a list Iran is not on. We read both on those companies own pages and they are recorded with dates in the AI reference section.

The practical consequence is that many people work through a purchased account or somebody account in another country, and this is where the privacy question changes shape. When the account is not yours, three things go at once: your chat history sits under someone who holds the account email; the model training setting is theirs to decide, not yours; and if data is ever mishandled you are not that company customer, so there is no complaint of yours for anyone to record.

We neither sell accounts nor recommend circumvention. What can honestly be said is this: as long as the account is not yours, client data must not go into it, and that ruling depends on no setting at all. For work that genuinely needs confidentiality two real options remain: the API under a contract through someone who has official access, or an open weight model run on your own hardware so that nothing leaves the machine.

Do not dismiss the second one. Open weights mean there is no supported country list, because there is nothing to grant permission for; that is an architectural fact and not a way around sanctions. In exchange the quality is lower and the hardware is more expensive, and for Persian text that gap is noticeable. The question of cost and how to pay stays exactly where it was.