Does your AI vendor train on your data? Where the answer actually lives
It depends on three things. The plan on your invoice, the account your staff signed in with, and one setting left at its default. The answer lives in the vendor's own terms, scoped to a named plan. Anthropic, Google and Microsoft all updated those pages in 2026, so read the current one.
- The training answer is scoped to a plan name, not to a product. Anthropic splits its own privacy center in two before you read a word, one set of articles for commercial plans and one for consumer plans.
- On consumer Claude plans, Anthropic says data can sit in model training pipelines for up to five years when the setting is on, against 30 days for a deleted chat when it is off.
- Microsoft states that Copilot prompts and responses are not used to train foundation models, and that the web search queries behind those answers fall under a different agreement with Microsoft as an independent controller.
- Google's consumer Gemini notice asks users not to enter confidential information, because human reviewers read some chats and reviewed chats are kept up to three years.
- One dropdown can move your data onto another company's paper. Microsoft's models labeled Anthropic models with Data Retention are off by default and sit outside its own Product Terms and DPA.
Does your AI vendor train on your data?
It depends on the plan, and the two halves of one product often disagree. On a paid business plan, each vendor we read commits not to train on your content. On a consumer plan that commitment gets weaker or reverses outright, and neither answer counts until you read it in the vendor's own document. Every commitment is written against a named plan. Three things move the answer, and none of them appear on the marketing page.
The behavior behind the question is already normal in small firms. Verizon found that frequent usage of AI tools by employees has surged from 15 percent to 45 percent of employees in a single year, and now ranks shadow AI as the third most common non-malicious data leakage related activity. Your staff are not waiting for a policy. So the useful question is narrow. For the tools they already use, what do the current terms say, and where exactly is that written?
Three things change the answer. The plan you pay for, the account the person signed in with, and a setting left at its default. A fourth catches out careful buyers, which is one feature inside a product sitting under a different contract than the product around it. We read the current Microsoft, Google and Anthropic documents on 21 October 2026 and quote them below.
These terms change often, so treat the vendor's current page as the authority and this article as the map to it. Google's generative AI privacy pages alone carried three different October 2026 dates when we read them, including 6 October on the Workspace hub and 13 October on the consumer notice. Quote the sentence, note the date, re-read it at renewal.
This guide is the research skill. For the behavior itself, and the sanctioned account that fixes most of it, read Your staff are pasting client data into ChatGPT. For what an assistant does to your file permissions, read Copilot sees everything your users can see. For the policy document, read Shadow AI: how to write an AI use policy.
Where does the training answer actually live?
The answer lives on the vendor's own site, inside a paragraph scoped to a named plan, and it ranks below the contract you signed. Five documents can answer the question. They carry very different weight, listed below from strongest to weakest.
- Your contract and its data processing addendum. This governs. Microsoft states that organizational use of Copilot is covered by the terms of the Microsoft Products and Services Data Protection Addendum (DPA) and Microsoft Product Terms, with Microsoft acting as a data processor.
- The vendor's published terms of service. These bind, and the consumer and commercial versions are two separate documents with different defaults.
- The trust center or privacy hub. The vendor's own plain-English summary, usually dated and usually scoped to named plans.
- The help article. Specific, readable, and not a contractual commitment. Anthropic's own training article sends readers to its Trust Center and Commercial Terms for the detail.
- The marketing page. No weight at all. It names no plan and carries no date.
Then read the scope sentence before you read the training sentence. That habit prevents most errors here. A true sentence about the wrong plan is not a weaker answer. It is often the opposite answer, stated confidently. Anthropic's privacy center opens with two collections, one for commercial customers covering API, Console, Team and Enterprise plans, and one for consumers covering Claude Free, Pro and Max. Google states that this Privacy Hub only applies when you are using Gemini and Gemini Notebook with a qualifying edition. Microsoft footnotes that the specific controls will vary depending on a customer's Microsoft subscription plans.
The load-bearing sentence in a vendor's terms is the one that says who the document applies to, not the one about training.
Why does the plan name on your invoice decide the answer?
The plan name decides because each vendor writes its training commitment against a plan rather than a product. Claude is one product with two opposite defaults, and the dividing line is the plan you pay for.
On the commercial side, Anthropic states that by default, we will not use your inputs or outputs from our commercial products to train its models, and the same article scopes itself to our commercial products such as Claude for Work and the Anthropic API. That article was last updated on 18 August 2026.
On the consumer tier, the position reverses. Anthropic's privacy policy, effective 10 September 2026, states that we may use your Inputs and Outputs to train and improve Anthropic AI models, unless you opt out through your account settings. Data retention then follows that setting. With model improvement on, Anthropic says it may retain your data in a de-identified format for up to 5 years in our model training pipelines. With it off, deleted conversations are deleted from our back-end storage systems within 30 days. Same product, same prompt, roughly sixty times the exposure window.
Two naming traps sit in this step. Microsoft renamed the product, and its own documentation warns that some experiences, licenses, and capabilities might continue to reference Microsoft 365 Copilot, so the string on your invoice may not match the heading on the page. Google's hub covers only a qualifying edition, so a mixed tenant where some staff hold a license and some do not has two answers at once. Read the invoice first, then match that exact plan name in the document.
Does the account your staff signed in with change the answer?
Yes, and Google says so in its own consumer notice. The same person, on the same laptop, typing the same prompt gets different handling from a work account than from a personal account.
Google's consumer Gemini Apps Privacy Notice, last updated 13 October 2026, tells users that if you have a work or school Google Account, your use of Gemini Apps may be subject to different data handling terms. That cross-reference is the most valuable sentence on the page, because it tells you the page you are reading may not be the one that governs you.
The consumer wording still matters, because that is where a personal account lands. Google states that human reviewers, including trained reviewers from our service providers, review some of the data, and asks users directly, please don't enter confidential information that you wouldn't want a reviewer to see. Activity is auto-deleted after 18 months by default, which the user can change, while reviewed chats are retained for up to three years and survive deleting your activity.
On a qualifying Workspace edition the commitments change. Google states that user prompts are considered customer data under the Cloud Data Processing Addendum, that Workspace does not use customer data for training models without customer's prior permission or instruction, and that your content is not human reviewed or otherwise used for Generative AI model training outside your domain without permission. Read the final qualifier rather than the headline. Both commitments are conditional on permission, which is how they should be quoted and how an honest provider will quote them to you.
Microsoft ties its protection to the identity too. Its support page states that Copilot Chat automatically provides enterprise data protection when you're signed in with that account, meaning a work or school account. Prompt logging continues either way, and that is the honest part. Microsoft says your prompts, Bing search queries triggered by your prompts, and responses in Copilot Chat are logged, and that your IT administrator can view them with Microsoft's search and audit tools. That page carries no publication date, which is why we read the dated Learn pages beside it.
Can one default setting change what the vendor keeps?
One default setting moves consumer retention from 30 days to five years on the same plan. The document gives you the default. Only the account gives you your state, so somebody has to open the settings page and look.
Anthropic describes that setting two ways in two documents, and both are accurate. The privacy policy states the default plainly, that data is used unless you opt out through your account settings. The privacy center article, last updated 8 June 2026, frames it as a choice, saying Anthropic may use your chats and coding sessions to improve Claude, if you choose to allow us to. A legal document states the position. A help page describes the prompt the user saw. Neither tells you which way your own staff clicked.
Three details decide what the setting actually does, and all three sit in Anthropic's own wording.
- Timing counts. Anthropic states that the five-year period only applies to new or resumed chats after the model training setting has been enabled, so the date of the click sets the scope.
- Opting out has two exceptions. Anthropic will still use content for model improvement where conversations are flagged for safety review, or where you've explicitly reported the materials to us, for example via our feedback mechanisms.
- One mode is excluded outright. Anthropic states that your Incognito chats are not used to improve Claude, even if you have enabled Model Improvement.
Feedback buttons are the quiet exception, and they deserve one line in your own rules. Anthropic says it may use feedback to train our AI models as permitted under applicable laws and retains it in our secured back-end for up to 5 years, de-linked from user and customer IDs, and it lets a Primary Owner or Owner on a Team or Enterprise plan disable that feedback option. Microsoft says it may use optional customer feedback to improve Copilot, but that it does not use this feedback to train the foundation LLMs. A thumbs up on a client document is a separate decision from the plan you bought.
What does a no on training still not tell you?
A no on training leaves four questions open. Who reads the content, how long it is kept, which legal role the vendor holds, and which features inside the product are carved out of the deal. The fourth one surprises nearly everybody.
Microsoft Copilot is the clearest worked example, and it shows good documentation rather than bad. Microsoft states that prompts, responses, and data accessed through Microsoft Graph aren't used to train foundation LLMs, and that while abuse monitoring includes human review of content in Azure OpenAI, Microsoft Copilot services have opted out of it. Then web grounding happens. Microsoft states that the Bing search service operates separately from Microsoft 365 and has different data-handling practices, covered by the Microsoft Services Agreement between each user and Microsoft, and that for those queries Microsoft acts as an independent data controller. Those queries still aren't used to train our foundation large language models. What changes is the governing contract and Microsoft's own legal role.
That carve-out has teeth in writing. Microsoft footnotes that HIPAA compliance doesn't apply to web search queries as they aren't covered by the DPA and Business Associate Agreement (BAA), and that the EU Data Boundary doesn't apply to web search queries. For add-ons, Microsoft tells administrators to check the privacy statement and terms of use of the agents to determine how they'll handle your organization's data, which moves the answer into a third party's document.
A model picker can move your data onto another company's paper. Microsoft confirms that Anthropic has onboarded as a Microsoft subprocessor, enabled on by default for most customers in commercial cloud (excluding EU/EFTA and UK). Ordinary Anthropic models stay under Microsoft's terms. Models labeled Anthropic models with Data Retention do not. Microsoft states that for those, data is stored by Anthropic and not subject to your Microsoft Customer Agreement including commitments in the Product Terms and DPA, that they are off by default for all scenarios until a tenant administrator opts in, and that Anthropic acts as an independent processor. Anthropic then stores most inputs and outputs for up to 30 days and doesn't use retained data for model training without your express permission.
Zero data retention is the last trap, because it sounds like a plan feature and is not one. Anthropic states that the only products to which zero data retention applies are eligible Anthropic APIs, products using a commercial organization API key, and Claude Code for Enterprise plans. Buying a Team or Enterprise chat seat does not buy it. Ask which of your tools it covers today, and get the answer in the vendor's words.
How do you read an AI vendor's terms in 20 minutes?
To read a vendor's terms in 20 minutes, work the plan name first and the training sentence last. Seven steps, one tool at a time. The output is a dated quote you can hand to an insurer, an auditor or a client who asks.
- Pull the exact plan name from your invoice, not from the login screen.
- Open the vendor's own domain and nothing else. A competitor comparison page is not evidence.
- Find the scope sentence that names which plans the page covers, and confirm yours is named.
- Copy the training sentence verbatim, with the page's own date beside it.
- Check the setting inside the account, per user, because the page gives the default and only the account gives your state.
- List the extras, including web grounding, agents, connectors and model choices, then chase each one to its own document.
- Save a dated PDF, because the page will change and your copy becomes the record.
Never characterize a vendor whose page you could not read, and we applied that rule to ourselves. OpenAI's own privacy pages refused our requests on 21 October 2026, so this article makes no claim about OpenAI's terms. A vendor claim you cannot trace to that vendor's own current page is a rumor with a footnote.
The stakes justify the half hour. IBM found that among organizations reporting an AI-related breach, 92 percent lacked proper AI access controls, and that only 40 percent of organizations reported using access controls on AI models and data. CISA, the National Security Agency, the FBI and international partners published joint AI data security guidance on 22 May 2025 that highlights the critical role of data security in AI outcomes. Reading the terms is the cheapest control on that list.
What should you ask your IT provider this week?
Ask five questions, and ask for the sentence rather than the summary. A provider doing this work answers with a quote, a plan name and a date. A provider selling you something answers with a product name.
- Which plan are we on, by name, and which sentence covers it? A good answer is a dated screenshot of the vendor's page. A weak answer is that we are on the business one.
- Who is the controller for every part of the product? A good answer names the web grounding carve-out and any agents. A weak answer treats the product as one thing.
- Which subprocessors and model providers are enabled in our tenant? A good answer names the admin center setting and the date it changed.
- Where is the model training setting for each account, and who verified it? A good answer is a per-user check with a date, not an assumption.
- When did you last re-read these pages? A good answer is a month in 2026, because these documents move several times a year.
None of this makes a paste reversible, and no honest provider promises that it does. It gives you something better than reassurance, which is a dated sentence from the vendor's own document, matched to the plan you actually pay for, for each tool your staff already use. Keep the file. Re-read it at renewal. Most firms your size have never done it once.
FAQ
Does Microsoft Copilot train on your data?
No, on an organizational license. Microsoft states that prompts, responses, and data accessed through Microsoft Graph aren't used to train foundation LLMs. The web search queries behind those answers are not used for training either, though Microsoft says they fall under the Microsoft Services Agreement between each user and Microsoft, with Microsoft as an independent controller.
Does Google Gemini train on your data?
It depends on the account. On a qualifying Workspace edition, Google states that Workspace does not use customer data for training models without customer's prior permission or instruction. On a personal account, Google says human reviewers review some of the data and asks users not to enter confidential information that you wouldn't want a reviewer to see.
Does Claude train on your data?
It depends on the plan. For commercial products, Anthropic states that by default, we will not use your inputs or outputs from our commercial products to train models. On consumer plans, its privacy policy says data may be used unless you opt out through your account settings, with retention up to 5 years in our model training pipelines when that setting is on.
Where do you find out whether an AI tool trains on your data?
On the vendor's own site, in the document scoped to your exact plan name. Start with your contract and its data processing addendum, then the published terms, then the trust center or privacy hub. Anthropic splits its privacy center into separate collections for commercial and consumer plans, so pick the right collection first.
Is a help article enough proof, or do you need the contract?
The contract governs and the help article explains. Microsoft states that organizational Copilot use is covered by the Microsoft Products and Services Data Protection Addendum (DPA) and Microsoft Product Terms, with Microsoft acting as a data processor. Quote the help page for the operational detail, keep the contract for the commitment, and record the date on both.
Best IT MSP is the independent directory of vetted managed IT and cybersecurity providers across the US and Canada. Organic ranking is earned on rating and verified data, and paid placement is always labeled. Take the five questions above to three merit-ranked firms in your city and compare the answers side by side.