ChatGPT Privacy, in Plain English: What Really Happens to What You Paste

On ChatGPT's free and personal paid plans, the default arrangement is simple: what you type may be used to improve the service. In practice, that means your conversations are processed by automated systems, may be reviewed by people in limited cases such as safety checks, and may be used to train future versions of the model unless you change the setting. OpenAI's help article on how your data is used confirms this default. OpenAI provides controls for this: a data-controls setting that turns training off, temporary chats that are not saved to your history or used for training, and the ability to delete old conversations. Deleting a conversation removes it from your view and schedules it for removal from OpenAI's systems, typically within about thirty days. Two things are worth holding onto. Turning training off applies going forward; it does not reach back into conversations already used. And no setting turns a consumer product into a vault.

ChatGPT's business plans—the team and enterprise tiers—and OpenAI's API work under a different default: customer content is not used to train the models (see OpenAI's enterprise privacy page). Conversations live inside a workspace that belongs to the company, so an employee who leaves can be removed and the company's chats stay with the company. The same consumer-versus-business split exists at Anthropic and Google: consumer tools are allowed to learn from the data they receive, while business tools charge money instead. Two cautions keep this honest. Terms change, so verify the current data-use policy before you rely on it. And “not used for training” is not the same as “nothing to think about”—a business plan changes the vendor's rights, not your employees' habits. In my experience coaching owners, the privacy incidents that actually happen are not the vendor misusing data; they are an employee pasting the wrong thing in the first place.

Settings are the backstop; habits are the front line. The owners I coach get more protection from five plain sentences, repeated until they are boring, than from any configuration screen. Here are the rules of thumb I suggest handing to your team this week. They require no technical knowledge, they survive every terms-of-service update OpenAI will ever ship, and they work identically for Claude, Gemini, and whatever arrives next year.

Rules of thumb are a start; a written policy is the moment the rules become official. Your company has crossed the line into needing one when any of these are true: client contracts or NDAs restrict how you handle client information; your business touches regulated data—health records, financial data, personal data at scale; more than a handful of employees use AI tools every week; or you have already had the small scare, the paste you wish someone had not made, and you caught it only by luck. A written AI policy does not need to be long. The version I give owners is one page: an approved-tools list, a never-paste list, a disclosure rule, and a named owner with a review date.

That one-page policy is published on this site as a template you can copy clause by clause: my AI usage policy template walks through what each clause does and how to roll it out in one thirty-minute meeting. And when the policy raises the harder question—how does our team get genuinely good at these tools, inside the guardrails, on our real workload—that is the work I do with owners in 1-on-1 coaching: a human teacher, not an AI coach bot. Clear rules keep your information where it belongs; training turns the tools into hours back.