See where your prompts go after you hit send
Every prompt you send to a hosted AI model lands on someone else’s servers — and what happens next varies enormously by provider, product and plan. Some keep your data for 30 days of abuse monitoring then delete it; some train on it by default unless you opt out; a few offer zero-retention contracts. This reference collects retention and training behaviour for the major providers into one searchable table so you can answer “does this leak our data, and for how long?” without reading a dozen policy pages.
How to read the table
Each row summarises one provider product across the dimensions that matter for privacy and compliance:
- Retention window — roughly how long inputs/outputs are stored before deletion (often a fixed abuse-monitoring period for API tiers).
- Trains on your data by default — whether your content feeds model improvement unless you act. This is the single most important column for business use.
- Opt-out / ZDR — the route to stop training or to obtain zero data retention, where one exists.
- Tier — because the API, enterprise and free consumer products of the same provider frequently have different answers.
Filter by “no training by default” to quickly shortlist providers suitable for sensitive workloads, then confirm against the provider’s own policy page.
Notes and tips
- The product matters more than the brand. A provider’s enterprise API may be zero-training while its free chat app uses conversations for improvement — never generalise from one to the other.
- For regulated or personal data, prefer tiers offering a data-processing agreement and, ideally, zero data retention, and document the choice in your GDPR records.
- Retention for abuse monitoring still applies even when training is off — factor that window into your data-minimisation and breach-impact analysis.
- Policies change often. This is a convenience snapshot, not legal advice or a contract — always confirm against the live policy before you rely on it.