What actually happens to your data
Safety and privacy in the AI era · Lesson 1 / 20
Three things happen to your message
- Processing. The text is passed to the model and processed. This is unavoidable — it's how you get an answer.
- Storage. The conversation is kept in your account history, usually on the company's servers and in logs.
- Possible use for improvement. In free chat products your data may be used to train models — unless you've turned that off.
Most concern focuses on the third point, but the second is the one people underestimate: your history exists somewhere regardless of the training setting.
Browser chat ≠ API
- Ordinary chat (free or subscription): data may be used to improve models unless disabled; history is stored in your account.
- API and business plans: normally not used for training by default, with contractual guarantees.
This distinction is why "our company uses AI" and "our employees use ChatGPT from personal accounts" are entirely different risk situations.
What the company can see
In principle: your account, your conversation history, technical metadata. In practice, access is restricted internally, but "restricted" is not "impossible". Treat anything you type as something a person could in principle read.
The practical conclusion
Not "don't use it" but "know what you're sending". Most work tasks can be phrased so that nothing sensitive leaves your machine at all — which is what the next lesson is about.
Insight. Disabling training on your data is not the same as no storage. Your conversation history stays with the company either way.
Common mistake. Using a personal free account for company data. This breaches most employers' policies.
Pro tip. Check your settings right now — the toggle is usually called "improve the model for everyone" or "use my data for training".
Cheat sheet
- A message is processed, stored, and possibly used for training.
- Chat and API have different default terms.
- Turning off training doesn't delete history.
- Personal accounts are not for work data.
1. Does turning off training mean your data isn't stored?
2. How do API and business plans usually differ?
3. What's the practical conclusion?