D&S-03: Will It Train on Your Data?

Part 3 of the Data & Security series. In Part 2 we looked at what plan tiers really change. Here is the question underneath all of them, answered vendor by vendor.

Will it train on your data?

Six words, and the answer depends less on the vendor than on which door you walked in through: the personal one or the business one. I checked the published terms of the four tools companies ask me about most, in October 2026. Terms change, so treat this as a map, not a contract, and check the current page before you sign anything.

ChatGPT

Personal accounts (Free and Plus): your conversations may be used to improve the models, unless you turn that off in the data controls or use Temporary Chat. The switch exists, but you have to know it is there.

Business accounts (Team, Enterprise, Edu): OpenAI states that business data is not used for training, by default. No switch to find. That difference, one sentence in the terms, is the whole argument for putting company work on company accounts.

Microsoft 365 Copilot

Copilot inside Word, Outlook, Teams and the rest of Microsoft 365 runs under Enterprise Data Protection for business customers. Prompts, responses and the files it grounds on are not used to train the foundation models. It also respects the permissions already inside your Microsoft tenant, so Copilot cannot show an employee a document they were never allowed to open. That second sentence quietly matters as much as the first.

Claude

Personal accounts: in 2025 Anthropic changed its consumer terms, and personal chats may now be used for training unless you opt out in the settings. If you allow it, retention is long. If you opt out, retention drops to a short window. The toggle is the story here: the default is not the private choice.

Business accounts (Claude for Work, Enterprise, and the API): customer data is not used to train models. Same pattern as the others. The business contract says no, so the answer is no.

Gemini

The Gemini app on a personal Google account: conversations can be kept in your account activity and used to improve Google services, depending on your settings. Turning activity off changes what is stored going forward.

Gemini inside Google Workspace: business terms apply, customer data is not used to train models, and the protections match the rest of Workspace. Again, the door decides.

The pattern, because there is one

Read the four sections again and the shape jumps out. On personal tiers, the answer ranges from “yes, unless you opt out” to “check your settings,” and the burden is on you. On business tiers, every major vendor makes the same promise, in writing: your data does not train our models.

So the practical rule for a company is embarrassingly simple. Company data goes in company accounts. Not because personal tools are villains, but because the promise you need only exists on the business side of the door, and it costs less than one hour of the cleanup after a client asks how their information was handled.

One last habit worth building: once a year, re-read the data page of whatever you use. Vendors change terms the way airlines change baggage rules, quietly and in their own favor. The next article looks at the companies that cannot afford to get any of this wrong: finance, health and legal, where the questions come with regulators attached.