AI Vendor Privacy Policies Compared: Will Enterprise Data Be Used for Training?

What actually happens when an enterprise hands its data to ChatGPT, Claude, or Gemini? The answer is buried in the policy pages each vendor writes for itself. On October 16, 2026, a family office technology lead went through the official documentation of OpenAI, Anthropic, Google, and Microsoft one by one. The conclusion wasn't "safe" or "unsafe"—it was a conditional matrix: it depends on which plan you're on, whether the training toggle is off, how long the retention clock has been running, how long the sub-processor list is, and who turned on which connector.

Training and Retention: Diverging by Plan

Start with the most frequently asked question: will vendors use your conversations to train models?

According to each vendor's own policy pages, the enterprise plans of OpenAI, Anthropic, Google, and Microsoft do not train on customer content by default. The risk is concentrated elsewhere: employees handling work matters on personal accounts, post-deletion retention windows, external processors, and stale sharing settings that AI can now read.

At the plan level specifically:

• ChatGPT Free, Plus, Pro: Trains by default unless the user manually turns it off. Deleted conversations are removed within 30 days, with legal and safety exceptions.
• ChatGPT Business, Enterprise, API: No training by default. Enterprise admins can set retention policies, and deleted conversations are also cleared within 30 days.
• Claude Free, Pro, Max: Trains only when the user actively permits it, except for conversations flagged by safety review. Deleted content is cleared within 30 days; if the user allows training, retained conversations may be stored de-identified for up to 5 years.
• Claude for Work and API: No training by default unless the user sends feedback or actively opts in. API inputs and outputs are deleted within 30 days.
• Gemini consumer app: Trains by default when Keep Activity is on. Default retention is 18 months; after Keep Activity is turned off, processing occurs within 72 hours; conversations reviewed by humans may be retained for up to 3 years.
• Google Workspace with Gemini: No training without permission, with retention policies controlled by admins.
• Microsoft consumer Copilot (updated August 18, 2026): No training. Activity history is retained until the user actively deletes it.
• Microsoft 365 Copilot: No training. Activity history is governed by the Microsoft 365 terms.

Three edge cases that are easy to miss deserve a place in enterprise policy:

Feedback is a side door. On OpenAI's individual plans, when a user clicks thumbs up or thumbs down, "the entire conversation associated with that feedback" can enter the training pool—even if the training toggle was previously turned off.

Human review outlives deletion. Google's Gemini page explicitly states that reviewed conversations "are not deleted when you delete your activity" and may be retained for up to three years.

Litigation can override retention policies. In The New York Times v. OpenAI case, a court required OpenAI to retain consumer ChatGPT and API content. That order ended on September 26, 2025, but OpenAI said it still stores limited historical data from April through September 2025. Enterprise and education editions were excluded.

Sub-processor is a core concept in data compliance: a third-party company that the primary service provider brings in to complete data processing tasks. For example, OpenAI outsources cloud hosting to Microsoft, CoreWeave, Oracle, and AWS, and content moderation to the Philippines-based TaskUs—these companies are all OpenAI sub-processors. Under regulations such as GDPR, data controllers must be informed of the full list of sub-processors and have the right to object to new additions. The risk lies in the lengthening chain of responsibility: if a sub-processor suffers a breach or receives a law enforcement request, the enterprise customer's contractual protections may not directly cover it. Therefore, when reviewing AI vendors, the update frequency and length of the sub-processor list are themselves risk indicators that need to go into your vendor onboarding checklist.

The Dependency Graph Behind a Single Prompt

A conversation doesn't stop at the AI vendor. OpenAI's sub-processor list (updated October 14, 2026) shows that cloud hosting for ChatGPT Business and Enterprise includes Microsoft, CoreWeave, Oracle, and AWS, while customer support and API content moderation are handled by TaskUs in the Philippines.

Microsoft 365 Copilot now lists Anthropic as a sub-processor. Microsoft says Anthropic models are "enabled by default for most customers in the commercial cloud"—except in Europe and the UK. If you manage a U.S. tenant and have never checked this admin setting, your Copilot traffic may already be flowing to a second model provider.

For family offices, RIAs, or venture firms, this means compliance review can't just look at the master contract—it has to trace the entire data chain: employees, the AI vendor, cloud hosters, support and moderation outsourcers, and any model partners the platform routes to.

Connectors Inherit Your Permission Debt

Microsoft 365 Copilot "only surfaces organizational data that a single user has at least view permission for." That's the correct access control design, but it also means a 2019 SharePoint site with overly broad sharing can now be searched in natural language.

In ChatGPT Business, OpenAI says "many apps are enabled by default," while new Enterprise workspaces start with a curated set. Enterprise organizations can ask OpenAI Support to block employees from connecting work accounts to personal ChatGPT.

For agents that take action (sending emails, archiving files), you need to decide in advance which operations require human confirmation. Sending funds and sending emails should be at the top of that list.

Connectors are the bridge through which enterprise-grade AI assistants access organizational data—think Microsoft Graph connectors or ChatGPT's enterprise app integrations. Their design principle is "permission inheritance": AI only surfaces content the current user already had permission to view, rather than bypassing permissions to read all data directly. This is theoretically correct, but in practice it amplifies legacy problems—if a SharePoint site was mistakenly set to be readable by everyone in 2019 and no one noticed at the time, today AI can retrieve that batch of files with natural language. Permission debt doesn't disappear on its own; it just shifts from "no one can find it" to "one sentence can pull it up." That's why the article emphasizes: before connecting any data source, fix sharing permissions first—don't try to remediate after connecting.

Five Questions to Test "Private"

A "no training" clause only answers one question. Before trust documents, deal room materials, and client inboxes go anywhere near any model, you need written answers to the following questions:

1. Where does it run? Whose hardware, in what location?
2. Who operates it? Who runs it day to day, and to whom are they accountable?
3. What gets sent back? Content, logs, usage data—or nothing at all?
4. Who can see what? What is the access model for individual records, and which operations require human intervention?
5. Where do the answers come from? Can every answer be traced back to a source document?

For any hosted service, the blunt answers to the first two questions are: the vendor's data centers and the vendor's employees. A hosted solution can still score highly on the other three.

The Shared Responsibility Model is the standard framework of the cloud computing era: the vendor is responsible for "the security of the cloud itself," and the customer is responsible for "the security of data and configuration in the cloud." The same applies to AI services—"we don't train on your data" is a vendor commitment, but "who has permission to access this data," "which files can the connector read," and "are employees logging in with personal accounts" are all customer-side responsibilities. Treating the five questions as a written review checklist is essentially about drawing that responsibility boundary: the first two questions (where it runs, who operates it) usually only accept the vendor's answer, while the last three (what gets sent back, who sees what, where answers come from) must be given verifiable answers by the enterprise itself. If any one cannot be answered, that means responsibility has fallen through.

This Quarter's Action Checklist

1. Inventory all AI accounts used for work last month, including personal accounts.
2. Turn off training toggles on personal accounts that have touched office content, or migrate that work to an enterprise plan.
3. For each vendor, read three pages: the training policy, the retention policy, and the sub-processor list. Write the key numbers into your AI policy.
4. Fix sharing permissions before connecting anything.
5. Define which data should never leave the family-controlled environment.

The value of this framework isn't in delivering a "safe" or "unsafe" verdict, but in letting technology leaders translate vendor policies into executable organizational rules. The real risk often isn't in the model itself, but in the blurred boundary between personal and enterprise accounts, the historical permissions connectors inherit, and the unexamined links in the sub-processor chain.