Explained / Where your data actually goes
If I paste something into an AI tool, who can see it?
The short answer
Two different things can happen to what you paste. It is used to answer you, which always happens and usually means it is stored for a while. And it may be used to improve the model, which depends entirely on the product, your plan and your settings. Those two are often deliberately blurred in marketing, and they carry very different risks.
Answering you and training on you are not the same thing
To answer at all, the service has to receive what you sent and process it on its own computers. That is unavoidable, and it normally means your text is stored for some period — for abuse monitoring, for support, or simply because systems keep logs.
Training is separate. That is when your text is added to the material used to improve future versions. This is the one that people picture when they worry, and it is the one most often switched off by default on paid and business plans.
So “we do not train on your data” can be entirely true while other things remain true as well. Your text still sits on a server. A human may still read it when a safety flag fires. It can still appear in a legal disclosure. It is a narrower promise than it sounds.
PIXEL / THE COACH
The sentence worth hunting for in any policy is not about training. It is: how long do you keep it, who can look at it, and what happens if somebody asks you for it.
The three questions that actually matter
Policies are long and written by lawyers. These three cut through most of it.
What to look for, and what a good answer sounds like
- Is it used for training?
- A clear yes or no, and whether you can change it in settings.
- How long is it kept?
- A stated period. “As long as necessary” is not a period.
- Who can read it?
- Whether staff or contractors may review it, and under what circumstances.
- What if I delete it?
- Whether deletion clears the copy used for training too, or only your view of it.
The shape of a sound policy rather than a quote from any particular one. Terms differ by product, plan and country.
Free, paid and work accounts are different products
The same brand can behave very differently depending on which door you came through. Consumer free tiers are the most likely to use your text for training. Paid consumer plans often turn that off. Business and enterprise accounts usually contract it away entirely, because the customer's lawyers insisted.
The account you happen to be signed into therefore decides what happens to your text, and people routinely have several. Pasting work material into a personal account is one of the most common ways a sensible policy gets quietly bypassed.
What to actually do
- Check which account you are signed into before pasting anything that is not yours.
- Find the training toggle in settings and decide deliberately rather than by default.
- Never paste identifiers you cannot take back: account numbers, health details, other people's information.
- If your workplace has an approved tool, use that one for work material, even when another is better.
The part that has nothing to do with policies
Once text leaves your machine you are trusting an organisation, and organisations have breaches, subpoenas, acquisitions and changes of mind. A policy is a statement of intent, not a technical guarantee.
None of that makes these tools unusable. It makes the redaction habit worth having: give it the shape of the problem rather than the identifying details, and most of the risk disappears without costing you any of the help.
BEEP / THE MYTH-BUSTER
A privacy policy is a promise about behaviour, not a lock. It cannot stop a breach, and it can be rewritten. The redaction you did before pasting still works in every one of those situations.
See it for yourself
Reading about it only gets you so far. This one is written to show you the thing described above, rather than describe it again.
What should I never paste into you? Answer for this product specifically, say what happens to what I do paste, and tell me the page where I can check that myself.
Then paste it into whichever assistant you use — ChatGPT, Claude, Gemini or Copilot. Not sure which? Meet them all.
If you remember nothing else
- Being processed to answer you and being used for training are two different things.
- “We do not train on your data” says nothing about storage, human review or disclosure.
- Ask how long it is kept, who may read it, and what deletion actually removes.
- Free, paid and work accounts on the same brand often have different terms.
- Redacting before you paste survives breaches and policy changes. A promise does not.
Where this came from
- ICO, Getting started with data protection for small organisationschecked 26 September 2026
Anything here that turns out to be wrong is worth telling us about. Figures that move — prices, sizes, energy use — are kept in the registry with their dates, rather than written into the prose where they would quietly go stale.
Questions about “Where your data actually goes”Asked by readers, answered by us. Open to read them.
Open to load them.
Ask about this page and we will answer it here, where the next person can read it too.
Nobody else can answer you, and you cannot answer anybody else. This is not a forum — we would rather say that than run a room we cannot watch at three in the morning.
Your question goes up with the answer and without your name. Nothing identifies you, ever.
If we cannot answer it we will tell you why, and that one stays between us.