AI AI and your privacy: data, training and opting out
Where your prompts actually go when you press send
The journey of a prompt: device, provider, sub processors and region, why enterprise and consumer tiers differ, and how to tell where your text is being handled.
The short answer
- Your prompt is processed on a company's servers in a data center you do not choose, not on your own device, unless you are running a local model on purpose.
- What gets transmitted is larger than what you typed: the hidden system prompt, earlier turns, saved memories and any attached files travel with every message.
- A single prompt can be held by four or five organizations, including the app vendor, the model provider, the cloud host and any sub processor named in the provider's list.
- Consumer, business, direct API and self hosted access to the same model carry genuinely different retention, region and training rules.
- Data residency commitments usually cover storage and main processing, so check in writing whether logging, support and human review stay in region too.
- A third party wrapper or browser extension adds another company holding your text, and it is usually the one with the smallest security team.
When you press send, your text leaves your device over an encrypted connection, lands at the nearest edge of the provider's network, and is routed to a data center that may be on another continent. There it is assembled into a larger package, scanned by safety classifiers, fed through model hardware, and written to a log. The answer streams back word by word from that same data center. Nothing about the conversation is computed on your phone or laptop unless you are deliberately running a model locally.
The useful question is not whether that journey is encrypted, because it is. It is how many separate organizations end up holding a copy of your words, under which contract, in which country, and for how long.
The path a single prompt takes
- Your client. The app, website or extension you typed into. It may store a local copy of the conversation and it decides what to send.
- Assembly. What gets transmitted is bigger than what you typed. A typical request bundles a hidden system prompt, the earlier turns of the conversation, any saved memories, the contents of files you attached and results from tools the assistant called. That whole bundle travels on every turn, which is why long chats cost more, as covered in what tokens are and why they decide your bill.
- Transport and edge. TLS encryption from your device to a front door server, commonly the nearest point of a content delivery network. Encryption protects the text from anyone in between. It does not protect it from the company at the other end.
- Routing to a region. The request goes to whichever cluster is available and permitted for your account. For a consumer account this is usually wherever the provider has capacity.
- Safety classification. Automated checks run on the input, and usually the output too. These run on every account tier and cannot be disabled.
- Inference. Your text is turned into tokens and processed on accelerator hardware. It lives in memory for the length of the request and is not written to the chips themselves.
- Logging. The request and the response are written to logs with your account identifier, timestamp, network address and device details, then retained for a stated period.
- Everything after. Retention, possible human review of flagged items, possible use for training depending on your tier and settings. That side of the lifecycle is covered in what a chatbot does with the personal data you type.
How many companies end up holding your text
People picture one company. In practice a single prompt can pass through four or five organizations, each with its own retention policy and its own breach risk.
- The application vendor. Whoever made the interface you typed into.
- The model provider. Often the same company, often not. Many products are a front end over somebody else's model.
- The cloud host. Model providers rent data center capacity. The hosting company operates the machines your text runs on, under a contract that normally forbids them from reading it.
- Sub processors. The support desk software that receives your bug report with a transcript attached, the analytics platform, the outsourced firm that reviews flagged content. Providers publish a sub processor list, and reading it is more informative than reading the privacy policy.
- Whatever sits in your browser. An extension with permission to read and change data on all sites can see the page you are on and the text you type into it.
Third party wrappers deserve special attention. A cheap app or extension that offers you a popular model is usually sending your text to its own server first, then calling the model provider with its own key. Your prompt is now stored twice under two different policies, and the smaller company is the one with the thinner security team. If the product is a browser extension that summarizes pages, it may also be transmitting the content of internal pages you had open, including systems your employer would never approve for outside processing.
Consumer, business and API are different products
The same model behind the same interface can operate under completely different rules depending on how you reached it.
| How you access it | Who holds your text | Typical retention | Region control | Training by default |
|---|---|---|---|---|
| Consumer app, free or paid | Provider and its sub processors | Account history until deleted | None offered | Often yes, with an opt out |
| Business or enterprise workspace | Provider, under your employer's contract | Often around 30 days, sometimes zero on request | Sometimes, by contract | Normally no |
| Direct API | Provider, under developer terms | Commonly around 30 days for abuse monitoring | Sometimes, by endpoint or setting | Normally no |
| Model hosted in your own cloud account | Your cloud provider | Whatever you configure | Yes, you pick the region | No |
| Third party app or extension | That vendor plus the model provider | Two policies, often unstated | Rarely | Depends on both |
| Model running on your device | You | Only what you save | Not applicable | No |
Paying for a consumer subscription generally buys capability, not different data handling. The change comes from a contract, which is why the terms worth arguing over are the ones described in the clauses to check in an AI vendor contract.
Where in the world it actually happens
Data residency means committing that your content is stored, and often processed, inside a named region such as the European Union or the United States. Consumer tiers rarely offer it. Business and cloud hosted setups increasingly do, and for regulated work it is frequently the deciding factor.
Read residency promises narrowly. A commitment to store data at rest in a region does not automatically mean every step happens there. Abuse logging, support tooling, incident response and human review often run globally, and a model routed for overflow capacity may be served from elsewhere unless the contract forbids it. The honest test is whether the provider will state in writing that inference, logging and review all remain in region.
The legal layer sits on top. In the EU and the UK, sending personal data to a provider outside the region requires a lawful transfer mechanism, typically standard contractual clauses or an adequacy framework, plus a data processing agreement naming the sub processors. In the US the constraints come from sector rules and state privacy laws rather than one general regime. This is general information rather than advice about your specific situation, and if you handle health records, financial data or children's data, the answer depends on rules well beyond the provider's terms.
How to find out for the tools you use
- Find the provider's trust or security page rather than the marketing page. Look for the sub processor list, the retention statement and any residency options.
- Check which account you are actually signed in as. A personal login inside a work browser profile puts your work text on consumer terms, and this is the most common real world failure by a wide margin.
- For any third party tool, ask one question: does my text touch your servers, and do you store it? A vendor who cannot answer plainly has answered.
- In an organization, ask the administrator whether the workspace is on a business agreement and whether zero retention was requested. It is usually opt in rather than automatic.
- Look at your own settings for training and memory, since those decide whether today's conversation shapes future answers. Turning training off is described in how to stop your chats being used for training, and what gets remembered between sessions in AI memory and chat history.
A checklist before you use AI for work
Five habits cover most of the risk without slowing anyone down.
- Use the account your employer pays for, in a browser profile that does not contain your personal login.
- Prefer one approved tool over five interesting ones. Each additional vendor is another copy of your text in another jurisdiction.
- Redact before pasting. Names, account numbers and identifiers can be replaced with placeholders, and the answer is just as good.
- Treat browser extensions as full participants in your data handling, because they are, and remove the ones nobody can justify.
- Write the rules down so people are not deciding case by case, which is the whole purpose of a short AI policy your team will actually follow.
If a category of work genuinely cannot leave the building, stop trying to solve it with settings. The only arrangement where your text does not travel is a model running on your own hardware, and the trade is smaller models, slower answers and maintenance you now own.
Common questions
Is my prompt encrypted?
Yes, in transit. The connection between your device and the provider uses the same encryption as online banking, so nobody on your wifi or at your internet provider can read it. Content is also normally encrypted while stored. Neither protects the text from the provider itself, whose systems necessarily see it in readable form in order to answer you.
Can I choose which country my prompts are processed in?
Not on a consumer account. Region choice is a feature of business agreements, developer platforms and models you run inside your own cloud account, where you pick the endpoint or the deployment region. If residency matters for your work, it has to be arranged through the contract before anyone starts using the tool, not selected later in a settings menu.
Does using a company VPN change where my prompt is processed?
Barely. A VPN changes the network path and the address the provider sees, which may steer you to a different edge location. It does not change which account you are using, which retention policy applies, or where the provider chooses to run the model. Treat it as a network tool, not a data governance control.
Are AI features built into my phone or operating system different?
Sometimes. Some device makers run small models on the hardware itself and only send harder requests to a server, occasionally through an arrangement designed so the server keeps nothing. The behavior differs by feature, and the setting that controls it is usually near the assistant options. Check the specific feature rather than assuming the whole system works one way.
What about file uploads and images, do they travel too?
Yes, and they are often retained separately from the chat text. An uploaded document is stored so the assistant can refer back to it, and it may persist after you delete the conversation that used it. Check the file or storage section of your account settings as well as the chat history, because clearing one does not always clear the other.