Data in cloud AI services: what to check before using them

Sending a question to an assistant, using a model API, or enabling an AI feature within another platform can involve different data processing. That is why a broad statement such as “the provider doesn’t use my data” is not enough to decide whether it is safe to upload a document, code, or customer information. The answer depends on the specific service, the account type, and the terms that apply to that feature.

Documentation should be read as a set of rules, not as a promise condensed into a sales page. Identify what data is processed, for what purpose, how long it is retained, and which options are available for the account in question. The practical rule is to verify each product and setting separately, rather than extrapolating a policy from one service to another.

Retention concerns how long information may be kept and for which operations. There may be differences between submitted content, the user-visible history, security logs, and data associated with a request. The fact that a conversation no longer appears in an interface does not, by itself, prove that all copies or logs have been deleted; that conclusion requires service-specific documentation.

Using data to improve or train models is a separate matter. OpenAI says ChatGPT’s controls let users choose whether conversations contribute to training, and that the availability of options depends, among other factors, on the plan and workspace settings. The same documentation explains that turning off “Improve the model for everyone” prevents new conversations from being used to train models, but they may still appear in history. Turning off training is not the same as deleting history or setting a retention period.

Training must also be distinguished from content review for security or abuse-prevention purposes. These are different purposes and may be governed by different rules. General documentation on business data does not replace the specific guidance for an API, feature, or plan. Before relying on an exclusion, check whether it applies to the tool you will use, what conditions it requires, and whether it must be requested or explicitly enabled.

Controls can vary by product, account type, region, or managed configuration. For ChatGPT, OpenAI notes that the options available depend on whether the user is signed in, their plan, and workspace settings. Do not automatically apply that caveat to other providers: it is an example of why the name of an option is not enough; you need to verify its scope and exceptions in the current documentation for the exact service.

Before using an AI service with your own information, locate its data policy and the product-specific instructions. Look for concrete answers to these questions:

• What is sent: inputs, attachments, outputs, metadata, and usage data.
• Why it is processed: service delivery, security, support, or model improvement.
• How long it is retained: periods for each data type and possible exceptions, such as security logs.
• Who can access it: the provider’s personnel, workspace administrators, or subprocessors, as applicable.
• What the customer can control: opting out of training, deletion, export, configurable retention, and permissions.
• Which account it applies to: personal, business, API, or another arrangement, and whether contractual terms change the general rule.

If the page does not clarify an important answer, do not fill in the gap with an inference based on another service. Consult the contractual documentation, admin settings, or the provider’s support channel. For organizations, the check should also cover who is authorized to enable controls and how data is handled under applicable internal and legal obligations.

The European Data Protection Board brings together information and policy work on artificial intelligence and personal data protection. That framework is relevant to assessing responsibilities and risks, but it does not, by itself, establish how long a particular service retains a request or which setting is active for an account. Those questions require the provider’s specific terms and guidance, as well as the actual configuration.

The AEPD’s materials on innovation and technology can serve as an institutional starting point for finding resources related to emerging technologies. Even so, a topic page does not replace a legal assessment of a case or confirm that a particular tool meets every applicable requirement. Regulatory guidance provides context; the service documentation and configuration determine the conditions the provider states for that use.

The available sources support a limited conclusion: for AI services, training, retention, and account controls need to be checked separately. Official ChatGPT help illustrates that a training preference can affect new conversations without necessarily removing history, and that options depend on the plan and workspace. This shows why a privacy option should not be interpreted as a universal guarantee.

There is no complete, current comparison of providers here, nor enough evidence to establish retention periods for specific services or claim that a particular option eliminates human review. Nor is a recent change presented that would justify breaking news. The useful conclusion is methodological: do not send sensitive information until you have identified the policy that applies to your service, account, and configuration, and record any point the documentation leaves unresolved.