“The AI does not train on your data” is only one part of a privacy assessment. Personal information can also be transmitted, stored, logged, retrieved, reviewed and disclosed during routine operation.
Draw the end-to-end path
Trace a real request through user device, application server, moderation filters, hosted model, retrieval database, logging service, plug-in tools, analytics and human support. Identify where each copy is created, who controls it and who can read it. Include metadata such as IP addresses and document titles, not just the obvious message text.
Classify information before entry
Public documents, internal material, regulated personal information and confidential trade secrets require different treatment. Establish approved examples and redaction rules for each category. A user should know whether the AI is permitted to receive employee records, unreleased source code or customer communications. If a workflow does not need personal details, remove them upstream.
Ask four independent questions
Training: can inputs or outputs improve a model? Retention: how long are content and logs stored, including abuse monitoring? Access: can subcontractors, reviewers or connected tools inspect them? Location: where does storage and processing occur, including backups and failover? A positive answer to one question does not answer the others.
Assign ownership and purpose
For regulated processing, identify the controller or equivalent accountable entity, processors, lawful purpose, security requirements, deletion procedure and incident contact as applicable. Obtain evidence such as a current data processing agreement and a scoped technical architecture, not a generic privacy badge. Rules vary by jurisdiction.
Example: employee feedback survey
A manager may want summaries without names. Strip direct identifiers, aggregate small groups cautiously, restrict access to raw responses, avoid sending logs to unrelated analytics products and verify whether small-group phrases allow re-identification. Have a responsible human review whether the published summary exposes staff members.
Practical decision
Do not enter sensitive material into an unapproved public assistant simply because it produces useful summaries. Verify plan-specific terms and feature-specific retention before use. Australia’s OAIC and the UK ICO both publish practical official guidance for these questions.
Sources & Further Reading
Guidance varies by jurisdiction and application. This is general education, not legal, medical or other professional advice.