What actually happens to the company data you paste into an AI tool

The line is not where you think it is

Almost everybody sorts AI tools into free and paid, and assumes paid means private. It is the wrong axis, and getting it wrong is how careful people end up pasting a client contract into a tool that will train on it.

The line that matters is consumer against business. ChatGPT Plus is a paid plan. It is also a consumer plan, and consumer plans train on your conversations by default.

Here is what each vendor actually commits to, taken from their own pages rather than from summaries of them.

OpenAI

For ChatGPT Business, Enterprise, Edu, and the API platform, OpenAI states plainly that it does not train its models on your data by default. Training happens only where somebody explicitly opts in, for example through a feedback mechanism. API inputs and outputs may be retained for up to thirty days for abuse detection and are then removed, unless retention is legally required.

For consumer ChatGPT, free or Plus, the default runs the other way. Conversations are used to improve the models unless you turn off the setting called "Improve the model for everyone," in Settings, under Data Controls. Turning it off keeps your chat history and stops the training use. It is one toggle, it is not on by default, and most people have never opened that screen.

So the split is not free against paid. It is whether the account sits inside a business workspace or not.

Anthropic

Anthropic changed its consumer terms in August 2025. Free, Pro and Max users were asked to choose whether their conversations could be used to improve Claude, with a deadline of 8 October 2025 for existing users.

The two numbers attached to that choice are worth keeping straight, because the coverage at the time ran them together. If you allow it, retention extends to five years. If you do not, you stay on the existing thirty-day retention period. The five-year figure applies only to people who opted in. It is not a blanket new retention period, which is how it was widely reported.

The commercial tiers are carved out entirely. Anthropic's announcement names them: Claude for Work, Claude for Government, Claude for Education, and API use, including through Amazon Bedrock and Google Cloud's Vertex AI.

Google

Consumer Gemini is the place with the fact most people have not heard, and it is the one worth remembering.

Google's Gemini Apps privacy documentation confirms that data is used to maintain, improve and develop its services, including the models themselves. It also states that a subset of chats are reviewed by human reviewers, including trained service providers. And then this: chats that have been reviewed by human reviewers are not deleted when you delete your activity. They are retained for up to three years.

Deleting your history does not reach back and unsee what a reviewer already read. That is not a scandal, it is written down in the open, and it is the single clearest reason not to treat a consumer assistant as a scratchpad for anything confidential.

Gemini in Google Workspace is a different product with a different commitment. Google states that Workspace does not use customer data to train or fine-tune its generative models without the customer's prior permission or instruction, that prompts stay within the organisation, and that content is not used for other customers. Those protections sit under the Cloud Data Processing Addendum, which means they are contractual rather than a setting somebody can flip.

Microsoft

Microsoft's position on Microsoft 365 Copilot is stated in the same terms: your data is not used to train foundation models, and prompts, responses and data accessed through Microsoft Graph are excluded from training. Prompts and responses are covered by the same contractual terms as Exchange email and SharePoint files, with tenant isolation and the usual data protection commitments.

One caveat in Microsoft's own documentation deserves more attention than it gets: web search queries are handled differently and are not covered by the same protections. If a Copilot answer involved searching the web, that part of the interaction left the protected boundary. It is a small sentence with a real consequence.

Worth holding alongside this: Copilot's strong training commitment does not mean the conversation is private from your employer. Those are separate questions, and the second one is covered in can your employer see what you type into ChatGPT.

The Samsung story, told honestly

Every article on this subject cites the same case. In 2023, Samsung engineers supposedly pasted semiconductor source code and internal meeting notes into ChatGPT, and Samsung banned the tool as a result.

The second half is documented. The first half is not, and the difference matters if you are using it to make an argument.

The original report came from a Korean business outlet in March 2023. It is frequently mistaken in English coverage for the British magazine of a similar name, which is part of why it travelled so far so fast. The Register relayed the story in April 2023 with hedging in nearly every sentence, and said in print that it had asked Samsung to confirm the details and had not received a response. Samsung has never publicly confirmed the specific incidents. The AI Incident Database catalogues the case as sourced to that one report.

What is on the record is the response. Bloomberg reported in May 2023 from an internal memo it had reviewed, and Samsung gave a direct statement confirming that it was temporarily restricting generative AI on company devices while it built a safer way to use it.

So the defensible version is: after reports in Korean media that Samsung has never confirmed, Samsung restricted generative AI on company devices, and said so on the record.

There is a larger point hiding in that correction. Searching for a well-documented, primary-sourced case of company data leaking through a consumer AI tool turns up remarkably little. The Samsung case is the canonical example precisely because there are so few, and it does not survive close reading as a confirmed leak. The evidence base is thinner than the volume of discussion implies. That is not a reason to be careless. It is a reason to be suspicious of anyone using a scary anecdote to sell you something.

What this means on a Tuesday afternoon

Five things that follow from the above, none of which require a policy document.

• Check which account you are in before you paste, not after. Personal accounts and business workspaces have opposite defaults, and they look identical on screen.
• If you are on consumer ChatGPT, open Data Controls once. One toggle, permanently.
• Treat consumer Gemini as reviewable. A subset of chats are read by people, and deleting your activity does not reach those.
• On Copilot, remember that a web-search step leaves the protected boundary even though the rest of the interaction does not.
• Strip identifiers before you paste, not names of ideas. Almost everything useful about a document survives having the client name, the account numbers and the unreleased figures removed. Almost nothing useful is lost.

The fear that gets sold about this subject is that AI tools are silently harvesting everything. The more accurate and less dramatic picture is that the defaults differ by product in ways the interfaces do not show you, and that ninety seconds spent in a settings screen settles most of it.

This is the groundwork for Using AI at Work.