What an AI chatbot does with the personal data you type

Everything you type into a chatbot leaves your device. It travels to a company's servers, gets written to a log with your account attached, sits there for a retention period that the provider sets, and may be read by a person if something in it triggers a review. Depending on your account type and your settings, it may also be used to help train the next version of the model. The conversation feels like a private window on your screen, but mechanically it is much closer to sending an email to a company you have never met.

That is not a reason to stop using these tools. It is a reason to know which parts of the lifecycle you can control and which you cannot.

The life of a single message

When you press send, roughly this happens.

1. The text is encrypted in transit and delivered to the provider's servers, along with your account identifier, a session identifier and usually your approximate location derived from your network address.
2. It is written to a conversation log so the chat can continue. The model has no memory of its own, so the entire conversation so far is resent on every turn. This is also why long chats cost more, as explained in what tokens are.
3. Automated classifiers scan it for prohibited content. This happens to every message, on every account tier, and cannot be switched off. It is how the provider enforces its own rules.
4. If a classifier flags something, the conversation can be routed to a human reviewer. A small sample of unflagged conversations may also be sampled for quality checks.
5. The log is retained. Typical stated windows run from about 30 days for deleted or temporary chats up to a period of years for active account history.
6. Separately, and only if your account and settings allow it, the content may be added to a pool used to improve future models.

Steps 1 through 5 happen regardless of what you toggle. Step 6 is the one with a switch.

Retention and training are different things

This distinction is the single most useful idea in AI privacy, and most confusion comes from collapsing the two.

Retention means the provider stores your conversation, associated with your account, and can produce it. It exists so your history works, so abuse can be investigated, and so the company can meet legal obligations. Turning off training does not shorten retention, which is a separate question from what deleting a chat actually removes.

Training means your text becomes part of the material used to adjust a future model's parameters. It is a one way process. Once a model has been trained, nothing about it points back at your specific sentence, and there is no practical way to extract that sentence back out or to remove it. But there is also no undo. This is why stopping your chats being used for training is a forward looking decision that you want to make before you paste anything sensitive, not after.

Your account tier changes the answer completely

Paying for a consumer subscription does not usually change the training default. That surprises people. The tier that changes it is the business or enterprise agreement, because that is a contract with commitments in it rather than a terms of service page that can be updated.

The things not to paste, and why

• Government identifiers. Social Security numbers, national insurance numbers, passport and driver's license numbers. These are the exact strings used to impersonate a person, and unlike a password you cannot rotate them.
• Other people's medical information. Your own is your choice. A patient's, a client's or a relative's is not yours to disclose, and in the US this can be a HIPAA problem for a covered entity.
• Credentials and keys. Passwords, API keys, recovery codes, database connection strings. Treat any credential pasted into a chatbot as burned and rotate it.
• Client confidential or privileged material. Unpublished legal advice, merger documents, source code under an NDA. The risk here is usually contractual rather than technical: your agreement with the client may simply forbid disclosure to a third party processor.
• Unpublished personal data about others. Home addresses, phone numbers, a colleague's performance notes, photos of children. Under GDPR and UK GDPR you can be the controller of that data, and sending it to a processor you have no agreement with is a problem in itself.
• Anything you are under a duty to keep. Financial records in a regulated firm, exam material, evidence in a live matter.

The cure is usually not abstinence but redaction. Replace real names with "Client A", real numbers with "XXXX", real addresses with "the address". A model can review a contract or draft a reply perfectly well when the identifying details are placeholders, and you can put them back yourself afterward.

Memory features raise the stakes

Many assistants now keep a running profile of facts about you across conversations: your job, your projects, your family, your preferences. That is convenient, and it also converts a one off disclosure into a permanent record that shapes every future answer. If you mention a health condition once, it can persist. Review what your assistant has stored periodically, and understand the difference between chat history and stored memory, which is covered in AI memory and chat history.

What to check first

Open your account's data controls and note three things: whether training is on, whether memory is on, and what your history setting is. Then look at which account you are actually signed in with when you do work, because plenty of people use a personal login on a work laptop without noticing, which is the sort of thing an AI policy at work is meant to settle. If the work genuinely involves confidential material, the strongest answer is not a toggle at all but running a model on your own device, where the text never leaves your machine in the first place.