The short answer: it depends less on which AI you use and more on which plan you’re signed in to.

Here’s how it usually goes. The office manager opens free ChatGPT on her phone and pastes in last year’s customer list to write a holiday postcard. The estimator drops a GC’s bid documents into his personal Claude account at 10 PM to pull out the scope. Nobody is doing anything wrong on purpose. But those two moves can land in very different places depending on the account and its settings.

Below is what the three big vendors say they do with your data, as of October 2026, with links to their own policy pages. Policies change often, so check those links before you make a decision.

Personal plans vs. business plans

All three companies draw the same line. Personal accounts can be used to improve their models unless you switch that off. Business accounts and developer APIs are not used for training by default.

ChatGPT (OpenAI). On Free, Plus and Pro, a setting called Improve the model for everyone is on by default. Turn it off under Settings, then Data controls, and new chats won’t be used to train OpenAI’s models (OpenAI data controls). Temporary chats are not used for training, but they may be kept for up to 30 days for safety. One catch: if you click thumbs up or thumbs down on a reply, the whole conversation may be used for training, even with the setting off (OpenAI). For ChatGPT Business, Enterprise and the API, OpenAI says it does not train on your business data by default (OpenAI enterprise privacy).

Claude (Anthropic). Since Anthropic changed its consumer terms in 2025, Free, Pro and Max users choose whether their chats can be used for training (Anthropic’s announcement). The switch is under Settings, then Privacy (how to change it). If you allow training, chats may be kept in de-identified form for up to five years. Incognito chats aren’t used for training, even with the setting on (consumer retention). On Claude Team, Enterprise and the API, Anthropic does not train on your chats by default, unless you send feedback or otherwise opt in (commercial training policy).

Gemini (Google). On a personal Google account with Keep Activity on, Google uses your chats to improve its services, including training its AI models. Some chats are read by human reviewers, and reviewed chats can be kept for up to three years (Gemini Apps Privacy Hub). Google’s own advice there: “Please don’t enter confidential information that you wouldn’t want a reviewer to see.” Even with Keep Activity off, Google still uses chats, sometimes with human reviewers, to keep the service safe. On a Google Workspace work account, the Gemini app is a core Workspace service on most editions. Google says it won’t use your data to train models without permission, and people won’t review your chats (Workspace privacy hub). If you build on the Gemini API, the same split applies: the free tier may be used to improve Google’s products and read by reviewers, and the paid tier is not (Gemini API terms).

The takeaway: put work on a business plan your company owns. A personal account with training turned off is better than nothing.

“Not used for training” is not the same as “not stored”

Training is half the question. The other half is how long your words sit on someone else’s servers.

  • Business chat plans keep your history so you can come back to it. On ChatGPT Business and Enterprise, deleted chats are removed from OpenAI’s systems within 30 days unless the law requires otherwise (OpenAI). On Enterprise, the owner can also set a custom retention period (OpenAI Academy). Anthropic also removes deleted chats on Team and Enterprise from its back-end systems within 30 days (Anthropic).
  • Google Workspace admins set the clock. The Gemini app can keep conversations for up to 36 months, and the default is 18 (Google).
  • APIs keep less. OpenAI may keep API inputs and outputs for up to 30 days to watch for abuse, and offers zero data retention for qualifying uses (OpenAI). Anthropic deletes API inputs and outputs within 30 days by default (Anthropic).
  • There’s always a legal exception. Every one of these policies says data can be kept longer if the law requires it. That is not theoretical. In 2025, a court order in the New York Times copyright case made OpenAI keep ChatGPT logs it would normally have deleted, until the order was eased that fall (Engadget).

So assume anything you type could be kept, and decide what goes in on that basis.

What admin controls actually get you

A business plan isn’t just a privacy setting. It changes who is in charge.

  • The account belongs to the company. Admins add and remove people. When your estimator leaves, you shut off his access that day. If he did the work in his personal account, it leaves with him.
  • You decide what’s connected. On ChatGPT Business, admins choose which apps and connectors can reach your email, drive or calendar at all (OpenAI). Claude Team has admin controls for connectors too (Anthropic).
  • Sign-in and records. Claude Team includes single sign-on. Enterprise adds audit logs and custom data retention, according to Anthropic’s plans page. Google Workspace admins can turn the Gemini app on or off for the whole company and set how long chats are kept.

Medical offices: you need a BAA and the right plan

If you’re a medical or dental office, HIPAA puts this in black and white. Using a cloud service to store or process patient information without a Business Associate Agreement (BAA) violates the HIPAA Rules (HHS guidance on cloud computing). Here’s where the three vendors stand as of October 2026:

  • OpenAI offers a BAA for its API and for sales-managed ChatGPT Enterprise and Edu accounts. It does not offer one for ChatGPT Business (OpenAI BAA help).
  • Anthropic covers its API and Claude Enterprise, but only after the account’s Primary Owner accepts the BAA and HIPAA support is turned on. Some features are excluded (Anthropic BAA details).
  • Google signs a BAA for Google Workspace and Google Cloud, and lists the Gemini app and Gemini in Workspace as covered, but not Gemini in Chrome (Google’s HIPAA list).

None of this covers a regular personal account like ChatGPT Plus, Claude Pro or a personal Gemini login. And a signed BAA on its own doesn’t make you compliant, as Google’s own HIPAA page points out. You still have to set the tool up the way the vendor’s HIPAA guide says. More on how we handle this for practices on our medical and dental page.

What never to paste, on any plan

Even on a business plan, some things don’t belong in a chat box:

  • Passwords, bank logins, API keys and the six-digit code your bank just texted you.
  • Full Social Security, card, bank account or driver’s license numbers. Even QuickBooks tells you to remove card numbers and government ID numbers from a receipt before you upload it (QuickBooks help).
  • Patient information, unless the tool is covered by your BAA.
  • Client files under an NDA or a professional duty of confidentiality, unless the client and your firm’s policy allow it. Law and accounting offices, see our confidentiality-first setup.
  • Employee and tenant records: medical notes, payroll details, rental applications, background checks.

Our rule of thumb: if you’d shred the paper version, don’t paste it into a personal AI account.

A short safety checklist

  1. Ask who is already using AI, and on which accounts. Don’t assume the answer is nobody.
  2. Move work onto one business plan the company owns. Pick ChatGPT, Claude, Gemini or Copilot based on the tools you already use.
  3. Check the training setting on any personal account that’s still in use.
  4. Write a one-page do’s and don’ts list and walk the team through it.
  5. Get the BAA before any patient data goes in, if you’re in healthcare.
  6. Check again every six months. These vendor pages change often, and a setting that was right in the spring may not be right in the fall.

This is exactly what we do in an AI Setup & Team Training visit: the right plan, on accounts you own, with your company info and rules loaded in and your people trained at your office. Our AI & data policy covers how we treat your data. Not sure where your team stands? Book a free visit.