Guide

Questions to ask about AI data retention and training

Five questions that expose what happens to your data in any AI tool, and how to get answers you can rely on.

By Adam GreenPublished October 10, 20265 min read

Vendor statements about data are claims, and they are often specific to a plan. Use these questions to get precise answers. This guide is general information, not legal advice.

What data does the tool receive?

List what you will actually send: prompts, files, source code, recordings, customer records. Then check whether the tool also collects usage or telemetry data, and whether you can turn that off.

How long is my data kept?

Look for a stated retention period, and whether it differs for prompts, outputs, and logs. Some vendors offer zero-retention arrangements for qualified accounts; find out what qualifies and who must request it.

Is my data used to train models?

Find the exact wording for your plan. A default of no training is different from an opt-in or opt-out setting, and different again from a contractual commitment. Record where the statement appears and the date you read it.

Who else can access my data?

Subprocessors and cloud providers that handle data on the vendor's behalf.
Vendor staff, for example for safety review or support.
Other users in your organization, through the tool's own permissions.

How do I delete my data?

Ask for the deletion process, its timeline, and what remains in backups or logs. For regulated data, ask how deletion is evidenced.

Frequently asked questions

Is data retention the same as training use?+

No. Retention is how long data is stored. Training use is whether the vendor uses it to improve models. A vendor can retain data without training on it, or the reverse, so ask about both.

Do free and paid plans handle data the same way?+

Often not. Terms can differ between consumer, team, and enterprise plans, so check the terms for the exact plan and ask for the answer in writing for business use.

Can I delete my data after I stop using a tool?+

Ask how deletion works, how long it takes, and whether copies in logs or backups are covered. Vendor documentation or the contract should say.