AI and privacy

Which AI company can a privacy-minded business trust with its data?

Ask where the data goes before you ask what the tool can do. The answer depends less on the company than on which product you use: consumer plans and business plans from the same vendor can have opposite defaults. This table is what each company says about its own products, with the page it says it on.

Checked against each vendor's own pages on October 14, 2026. Every cell links to its source. Prices and plans change often, so click through before you buy.

Anthropic

Claude

Consumer plan trains on your chats by default?
Yes on Free, Pro and Max unless you opt outThe pricing page lists model training as 'Opt-out' for the consumer plans. The switch is the Model Improvement setting in privacy settings.claude.com/pricing Model improvement privacy setting
Business plan trains on your data?
No training by default on commercial products, including API and Enterprise.Pricing page: Team shows 'No model training on your content by default'; Enterprise 'None by default'.Is my data used for model training? Claude pricing
Business data retention
API inputs and outputs are deleted within 30 days. Enterprise Primary Owners or Owners can set custom retention, minimum 30 days. Zero data retention is available by agreement.Chats in Team and Enterprise products are kept to provide the product experience; deleted chats leave back-end storage within 30 days. Custom retention is Enterprise only. Zero data retention is listed as an exception by agreement; the scope of eligible products was not re-verified.How long do you store my organization's data? Configure custom data retention controls for...
Keep data in one region
US-only inference is available at 1.1x token pricing. Developer Platform users can choose traffic routing location. Enterprise usage-based billing can enable US-only inference. Data is stored in the US.By default traffic may be routed to select countries in the US, Europe, Asia and Australia. The pricing page does not describe Enterprise region options itself; it links to platform data-residency docs. No EU storage option is stated.Claude pricing Where are your servers located?
Signs a DPA, offers HIPAA terms
DPA with SCCs is automatically part of the Commercial Terms. BAA covers HIPAA-ready services such as the first-party API and Enterprise plans.BAA covers only the single organization that accepted it; Enterprise needs a Primary Owner action; API needs Primary Owner signature and contacting Anthropic. Excludes Claude Console, Cowork in the cloud and beta features. The consumer-plans claim was not checked.How do I view and sign your Data Processing A... Business Associate Agreements (BAA) for Comme...
Public status page
status.claude.com shows uptime and incidents for claude.ai, Claude Console, the Claude API and Claude Code.Page loads and shows All Systems Operational with 90-day uptime.Claude Status
Who owns the outputs
Anthropic assigns to the customer its rights in Outputs, if any.Commercial Terms, subject to the customer's compliance with the Terms. Consumer Terms not checked.Anthropic Commercial Terms of Service
Our pick
Clearest commercial terms here: no training by default, 30-day deletion, DPA included, BAA available.

OpenAI

ChatGPT

Consumer plan trains on your chats by default?
Yes, unless you turn off 'Improve the model for everyone'The setting is under Data controls and covers Free, Go, Plus and Pro accounts, and Codex tasks on personal plans. Temporary chats are not used for training.Data controls in ChatGPT
Business plan trains on your data?
API: data not used to train or improve OpenAI models by defaultAPI only. Page states training exclusion from March 1, 2023 unless you opt in.OpenAI API data usage guide
Business data retention
API abuse monitoring logs retained for up to 30 days by default; approved customers can use Modified Abuse Monitoring or Zero Data RetentionZDR is only for approved customers and some endpoints are not ZDR-eligible. Business ChatGPT retention not found.OpenAI API data usage guide
Keep data in one region
Yes for API projects: data residency is a project setting with US, Europe (EEA and Switzerland), Australia, Canada, Japan, India, Singapore, South Korea, UK and UAE regionsAPI only on this page. Outside the US you must be approved for abuse monitoring controls and sign a Modified Retention amendment. ChatGPT business residency not confirmed.OpenAI API data usage guide
Signs a DPA, offers HIPAA terms
Not confirmedPage says the Decisions API is HIPAA eligible under an executed addendum; Web Search with live internet access is not covered.OpenAI API data usage guide OpenAI Trust Portal
Public status page
OpenAI Status page; covers ChatGPT (16 components) and the API (13 components), plus CodexOpenAI Status
Who owns the outputs
You own the Output; OpenAI assigns its rights in it to youTerms of Use, Ownership of content: you retain ownership of Input and own the Output, to the extent permitted by law. Output may not be unique, and the assignment does not cover other users' output.OpenAI Terms of Use
Our pick
The API terms are solid. For ChatGPT itself, turn off model improvement on personal accounts and use Business for work.

Google

Gemini

Consumer plan trains on your chats by default?
Yes, when Keep Activity is on. Default not stated on the page.Chats train AI models when Keep Activity is on. The page does not state the default setting. Users can turn the setting off.Gemini Apps privacy help
Business plan trains on your data?
No training on customer data without prior permission.Stated for Workspace with Gemini in the privacy hub. The Gemini API and its terms were not checked.Generative AI in Google Workspace Privacy Hub
Business data retention
Gemini in Workspace prompts and responses: 90 days to indefinite, as determined by admins. Gemini app: default 18 months, admins can set up to 36 months. History-off chats: up to 72 hours. Gemini Notebook: not retained after the session.The page does not use the term zero retention. API retention not checked.Generative AI in Google Workspace Privacy Hub
Keep data in one region
US or EU region for Gemini prompts, Enterprise tier for processing.Data regions page lists Gemini app and Google Workspace with Gemini (prompts and responses). Data at rest is covered by Fundamental, Education, Enterprise and Assured Controls; data processed in use only by Enterprise and Assured Controls Data Regions. Gemini Notebook is excluded per the privacy hub.Data covered by data regions
Signs a DPA, offers HIPAA terms
Cloud DPA governs Gemini use with Workspace apps. Gemini can support HIPAA workloads; Gemini Notebook is not covered by the BAA.Tier-dependent terms were not confirmed.Generative AI in Google Workspace Privacy Hub
Public status page
https://www.google.com/appsstatus/dashboard/ lists Gemini.The Workspace Status Dashboard lists Gemini and Gemini Notebook as services.Google Workspace Status Dashboard
Who owns the outputs
Google won't claim ownership of generated content.This clause is in Google's general Terms of Service. Workspace-specific service terms were not checked. The privacy hub does not state output ownership.Google Terms of Service
Our pick
Workspace data stays out of training and can be pinned to a region. The consumer Gemini app is a different story.

Microsoft

Copilot

Consumer plan trains on your chats by default?
Privacy statement says Microsoft may train AI models on your data; no opt-out namedConsumer terms say Microsoft may use Your Content to operate and improve Copilot, and that Copilot privacy options give control over some of those uses. No training opt-out is named on the pages checked. The privacy statement sentence is general, not specific to Copilot chats.Microsoft privacy statement Copilot consumer terms of use
Business plan trains on your data?
Prompts, responses and Graph data are not used to train foundation LLMsCovers Microsoft Copilot (formerly Microsoft 365 Copilot) for commercial customers. The page is dated updated 2026-10-08. The API and third-party model terms were not checked.Data, privacy and security for Microsoft Copilot
Business data retention
Kept in user's Copilot history; admins set Purview retention. Default not stated.Zero retention is not stated. The Purview page says messages generally stay unless a user deletes the chat or a history-deletion request is made, and that Purview retention policies can retain or delete them, with permanent deletion taking about 1 to 16 days after expiry. Users can delete their own Copilot activity history.Learn about retention for Copilot and AI apps Data, privacy and security for Microsoft Copilot
Keep data in one region
Residency via Advanced Data Residency or Multi-Geo; LLM calls can go elsewhereThe page says ADR and Multi-Geo include data residency commitments for Copilot customers as of March 1, 2024. EU customers get EU Data Boundary handling. LLM calls can route to other regions when capacity is short, and Anthropic models are currently excluded from the EU Data Boundary.Data, privacy and security for Microsoft Copilot
Signs a DPA, offers HIPAA terms
DPA by default; HIPAA BAA available, with Microsoft Copilot in scopeCommercial Office 365 tier. The HIPAA page lists Microsoft Copilot and Microsoft Copilot Chat in the Commercial and GCC in-scope table. The DPA document itself was not checked, but the HIPAA page says the BAA comes through the Online Services DPA.HIPAA and HITECH compliance offering
Public status page
status.cloud.microsoft, with detail in the Microsoft 365 admin centerThe public page shows an overall state per product family. Per-service incidents are behind the admin sign-in.Microsoft service health status
Who owns the outputs
Microsoft doesn't claim ownership of the output of the service.This does not say the customer owns outputs. The page adds that Microsoft makes no determination on whether output is copyright protected. The consumer terms say 'We don't own Your Content' (Prompts and Responses) but do not explicitly say the user owns outputs.Data, privacy and security for Microsoft Copilot
Our pick
Strongest compliance paperwork for a Microsoft shop: DPA, BAA, residency. Consumer Copilot may train on your data.

Meta

Meta AI and Muse

Consumer plan trains on your chats by default?
Yes by default for the Quest Meta AI app: text transcripts are stored by default to help improve Meta's products. Voice storage is optional.Applies to Meta AI on Quest only. The Meta news post says Meta uses chats with its AIs and 'may train our AIs on messages that people choose to share'. No global chat opt-out found; deleting transcripts in Activity Log stops their use.Meta AI on Meta Quest privacy notice Meta: Privacy Matters, generative AI features
Business plan trains on your data?
Standard API tier: no training on your Content. Discounted tier: Meta may train on Content.Model API only. Commitments page: 'In all cases, Meta does not use Customer Data (as defined in the Terms) to train its AI models.' Discounted Services allow training on Inputs and Outputs. No business chat product terms found.Meta Model API Data Commitments Meta Model API Terms of Service
Business data retention
Retained per Terms and Privacy Policy. Terms say Content and Usage Data are kept 'as needed' for service, legal, security and policy review. No period stated; no zero-retention option found.Terms Section 4.4. No admin control to shorten retention on pages we checked.Meta Model API Data Commitments Meta Model API Terms of Service
Keep data in one region
Not publishedNeither the commitments nor the terms page describes storage region or residency. Terms reference a Geographic Use Policy that governs access, not data location.Meta Model API Data Commitments
Signs a DPA, offers HIPAA terms
Processor terms published (Meta Global Processor Terms, applied to Standard Services). No HIPAA business associate agreement found; the terms tell customers not to share HIPAA data.Section 2.2 of the MGPT says not to share HIPAA-regulated information with Meta. No BAA mentioned. Model API terms Section 5.1 say Meta processes data as described in the MGPT.Meta Global Processor Terms Meta Model API Terms of Service
Public status page
Not publishedThe overview page names only the Help Center (dev.meta.ai/help); no status or uptime page found on allowed domains.Meta Model API overview
Who owns the outputs
Customer owns Inputs and Outputs, under applicable law and as between the parties (Model API terms, Section 4.1). Meta claims no ownership of Content.Consumer Meta AI terms not checked.Meta Model API Terms of Service
Our pick
The Standard API tier does not train and you own the outputs. The discounted tier does train, no HIPAA terms, and the consumer apps train by default.

The plan decides the privacy

Every company here offers a business product that does not train on your data by default. Most also offer a consumer product that does. The mistake is using the second for business work.

  1. 01Use the business tier for businessA personal plan, free or paid, is usually the one that trains. A business seat usually is not. Check the row, not the brand.
  2. 02Read retention, not just trainingNot training on your data and not keeping it are different promises. If you handle health or legal records, retention and a signed agreement are the bar.
  3. 03Write it downA one-page AI use policy that names the approved tool, the plan, and what never goes in the prompt is the right first step for most small businesses.

If a vendor cannot show you the page where it says it does not train on your data, assume it does.

Spearworks AI

Want a one-page AI policy your team will follow?

I write it with you in one session: the tool, the plan, the three things that never go in a prompt, and the settings to change today. You keep the page.

Book a free consult

Nathan Spear · spearworksai.com

Spearworks Labs · All comparisons · Checked October 14, 2026. Not affiliated with any vendor listed.