The privacy settings of a consumer chat account cannot safely be assumed to match an enterprise subscription, API integration or connected feature—even when the underlying model name looks identical.
Separate training permission from operational storage
A provider may promise not to use business prompts to train its general models while still keeping some content for abuse prevention, billing, service operations, legal obligations or debugging. Storage can also occur in the customer’s own application, browser, analytics, retrieval systems and connected tools. “Not used for training” is not a synonym for “never retained.”
Ask about the exact scope
Record provider, product, account type, contract, endpoint, feature, region, configuration and the date the terms were checked. Find out whether opt-in or opt-out is the default, which administrators can change it and what happens to historic data. Different tools within a platform can have different treatment, especially file search, cache, batch jobs and agentic features.
Read zero-retention claims precisely
Some provider offerings have special eligibility criteria and exceptions. Anthropic’s own zero-data-retention documentation describes exceptions associated with legal requirements and flagged trust-and-safety cases. Other providers have different mechanisms. This illustrates why an unqualified cross-vendor retention table is unreliable. Verify the actual signed agreement and feature-specific documentation before relying on a label.
Make a vendor questionnaire
Request retention periods for prompts, outputs, logs, attachments, embeddings and backups; training-use authorization; subprocessors; deletion steps; data transfer mechanisms; incident notices; and evidence of customer-configurable controls. Ask how exported data and copies in connected third-party systems are handled.
Test your own boundary
Inspect application-side logs, observability payloads and access rights. An organization can accidentally retain private messages indefinitely in its own monitoring layer even if the model provider offers restricted retention. Limit access and require purpose-specific time limits.
Date and scope note
This is a structural guide current to 25 October 2026; no fixed provider price, retention day-count or regional guarantee is inferred for a plan not individually verified. See the product vendor’s primary privacy and contract documents for any procurement decision.
Sources & Further Reading
- Claude API data retention and zero data retention — Anthropic.
- Google Cloud Gemini data governance — Google Cloud.
- AI companies: uphold your privacy and confidentiality commitments — FTC.
- Privacy guidance for commercial AI products — OAIC Australia.
Guidance varies by jurisdiction and application. This is general education, not legal, medical or other professional advice.