AI tools & your data: what to check

Before you put company or client work into an AI tool, one question matters more than features or price: what happens to what you type in? Here is exactly what to check — and how to find the answer in any vendor’s own documentation.

The four questions that decide it

1. Does it train on your inputs?

Some tools use what you type to improve their models by default; many let you opt out, and most business/enterprise plans exclude your data from training entirely. Look for the words “training”, “improve our models”, or “opt out” in the privacy policy or a dedicated trust page.

2. How long is your data retained?

Retention ranges from days to indefinitely. Short, stated retention windows are a good sign; “we keep data as long as necessary” with no specifics is worth a second look. Check the data-retention or data-deletion section.

3. Where is it processed?

Processing region affects which laws apply (GDPR in the EU, and so on). If you have regulatory obligations, confirm the vendor offers processing in a region you can use. Look for “data residency”, “region”, or “sub-processors”.

4. What changes on business and enterprise plans?

The consumer free tier and the enterprise contract are often worlds apart. Enterprise plans typically add a Data Processing Agreement (DPA), no-training guarantees, SSO, and audit certifications such as SOC 2. If you are handling client data, this is usually the tier you need.

How to check it yourself

• Start at the trust or security page — most serious vendors have one, and it is written to be read.
• Search the privacy policy for “train”, “retention”, “delete”, and “sub-processor”.
• Look for a DPA and SOC 2 / ISO 27001 if the tool will touch client or regulated data.
• Prefer specifics over reassurance — a dated, concrete policy beats a warm paragraph.

Red flags

• No privacy or security page you can actually find.
• Training on your data with no opt-out on paid plans.
• Vague, open-ended retention.
• No DPA available for business use.

We link each tool’s own documentation on its overview, and we never assert a data-handling fact without pointing you to the source — policies change, so the vendor’s current page is always the authority.