AI data policies
How 15 AI providers keep, train on and license what you send them, across 40 products. Every answer quotes the provider's own policy.
| Provider | Product | Trains on your data | Default retention | Zero data retention |
|---|---|---|---|---|
| Anthropic (Claude) | Claude Free, Pro and Max (including Claude Code used with those accounts) Consumer app | Inferred Inferred on by default: the Privacy Policy and Terms train 'unless you opt out'. The help page says 'if you allow us'. No captured policy gives the setting's starting value. | Stated Kept chats: no fixed period, only 'as long as reasonably necessary'. The 'Standard Retention Timeframe' heading is empty. With training on: may be kept up to 5 years, de-identified. | Not stated The consumer captured policies do not mention zero data retention. Incognito chats are excluded from training, but their retention period is not stated for consumer accounts. |
| Anthropic (Claude) | Claude for Work (Team and Enterprise plans) and Anthropic Console Business | Stated Not used for training by default. | Stated Chats and coding sessions are kept in the product so you can continue them. No retention period is given. | Not stated ZDR agreements appear only in the API section. Whether ZDR covers Claude for Work is not stated; the linked article on covered products was not captured. |
| Anthropic (Claude) | Anthropic API API | Stated Not used for training. The Commercial Terms bar training on customer content, and the help page says the API is excluded by default. | Stated API inputs and outputs are auto-deleted within 30 days. Exceptions: features you control (e.g. Files API), ZDR or other agreements, Usage Policy enforcement, and legal requirements. | Stated Zero data retention is available by separate agreement. The captured policies don't say who qualifies, how to get it, or whether it overrides the flagged-content retention. |
| AWS Bedrock | Amazon Bedrock API | Stated No. AWS says your content isn't used to improve the base models and isn't shared with model providers. | Inferred Bedrock uses a 'zero operator access' model, storing or reviewing inputs and outputs only in listed cases. We infer most traffic isn't kept; the linked Data retention page wasn't captured. | Stated Eligible customers may request full ZDR for OpenAI models via their AWS account team. Enterprise Frontier Safeguards-eligible customers get Claude Fable 5/5.1 ZDR only through December 31, 2026. Criteria unstated. |
| Cohere | Cohere API / SaaS Platform: trial accounts (no payment method on file) API | Stated Yes in effect: Cohere may use de-identified trial inputs and outputs for research and to improve model performance and safety. For EU/UK users it relies on legitimate interests, not consent. | Not stated No retention period is given for trial inputs and outputs. The 30-day figure in the policies is stated only for Enterprise (paying) Users. | Stated Not available to trial users. Cohere offers ZDR only to enterprise customers who make extra commitments about their usage. |
| Cohere | Cohere SaaS Platform: paying and enterprise customers Business | Inferred Default not stated. 'Opt out' wording suggests training unless toggled off, but the training notice says 'Where a user has given Cohere permission', implying opt-in. Unresolved. | Stated Prompts and generations are logged and automatically deleted after 30 days, unless an exception applies. | Stated Enterprise customers who make extra usage commitments can request ZDR via support@cohere.com. Then no prompts or generations are logged, but usage data is still collected. |
| Cohere | Private and third-party cloud deployments (VPC, on-premises, Model Vault, OCI/Azure/AWS/GCP) Enterprise | Stated No. Cohere says data in these deployments is never accessible to it and it does not train on it. | Stated Cohere says it receives no prompts or outputs, so retention is up to you or your cloud provider. It may still receive some usage data. | Stated No ZDR setting is described; Cohere says it receives no prompts or outputs here and points customers with sensitive data to these deployments. |
| DeepSeek | DeepSeek chat (app and website) Consumer app | Inferred Inferred on by default, since an opt-out exists. Inputs and outputs train models; the EU table lists User Input for training under legitimate interests, plus consent 'when we ask'. | Stated Inputs (prompts, files, chat history) and account data are kept for as long as you have an account. No fixed period in days is given. | Not stated The captured policies don't mention zero data retention for the chat app. |
| DeepSeek | DeepSeek Open Platform (API) API | Inferred The Open Platform Terms are silent on training. We infer the general Terms apply; they cover APIs and allow de-identified use of inputs and outputs to improve services. | Inferred The Open Platform Terms give no API retention period. We infer the privacy policy's 'while you have an account' rule covers developers' own data; end users' data falls outside it. | Not stated The captured policies don't mention zero data retention for the API. |
| Google (Gemini) | Gemini Apps (consumer, signed in) Consumer app | Inferred Inferred: with Keep Activity on, chats train Google's generative AI models; the hub never says outright that it's on by default. Audio and Live video/screenshares are excluded by default. | Stated Saved activity auto-deletes after 18 months by default (changeable to 3 or 36 months, or never). Temporary chats and chats with Keep Activity off are kept 72 hours. | Inferred Inferred: no zero-retention option exists. Even temporary chats and chats with Keep Activity off are kept 72 hours with your account and may be human-reviewed for safety. |
| Google (Gemini) | Gemini API and Google AI Studio, Unpaid Services (free tier) API | Stated Yes. Free AI Studio and free-quota API prompts and responses are used to improve Google products and machine learning. EEA, Swiss and UK users get paid-tier terms instead. | Stated No general retention period is stated for free-tier prompts. Grounding with Search or Maps keeps prompts and output 30 days. Tuning data is kept with the tuned model. | Not stated The Gemini API terms describe no zero-data-retention option for the free tier. |
| Google (Gemini) | Gemini API and Google AI Studio, Paid Services (Cloud billing) API | Stated No. On paid services Google doesn't use your prompts, files or responses to improve its products, and processes them as a data processor under the DPA. | Stated Prompts and responses are logged for a 'limited period' (length not stated) only for abuse detection and legal disclosures. Grounding with Search or Maps keeps data 30 days. | Not stated The Gemini API terms describe no zero-data-retention option. (The Agent Platform page covers ZDR for Cloud customers; see vertex-enterprise.) |
| Google (Gemini) | Gemini Enterprise Agent Platform (formerly Vertex AI) on Google Cloud Enterprise | Stated No. Google won't use your data to train or fine-tune any model without your permission or instruction. This covers all managed models, GA and pre-GA. | Stated No single default. Data is kept for limited periods in listed cases. Gemini models cache data by default (deleted within 24h). Interactions API stores prompts and conversation state by default. | Stated Requires your action: no request-response logging, store=false, no grounding, Deep Research or Sandbox captured policies, caching off. May be impossible with some Advanced AI features; OpenAI models need approval. |
| Hugging Face | Inference Providers (routed API to external providers) API | Stated Hugging Face says it doesn't store user data for training. Whether upstream providers train on requests depends on their own policies, which aren't captured. | Stated Hugging Face says it doesn't store request bodies or responses when routing. Debug logs are kept up to 30 days without user data or tokens. Each provider's own retention applies. | Inferred There is no named ZDR program. Inferred: Hugging Face stores no payloads and its logs exclude user data, so its layer is near-zero retention. Upstream providers set their own terms. |
| Hugging Face | Inference Endpoints (dedicated deployments) API | Inferred Probably not, but inferred: the page says payloads aren't stored, yet never directly addresses training. | Stated Hugging Face says it doesn't store payloads or tokens sent to an endpoint. It keeps logs for 30 days, and the page doesn't say what those logs contain. | Inferred There is no named ZDR program. Inferred: payloads aren't stored, but logs are kept 30 days and their contents aren't described. |
| Hugging Face | Hugging Face Hub with Team & Enterprise plans Enterprise | Not stated The captured policies don't say whether Hub content (private repos, datasets) is used to train models. | Stated Data is kept as long as needed for the Services, legal requirements, security and legitimate interests. No fixed period is given. Repository content stays until you delete it or cancel. | Not stated Not applicable to Hub storage, and no zero-retention option is described. |
| Instinct | Instinct personal assistant (text, web, Mac and mobile apps) Agent | Stated Yes, unless you opt out. Your information and Materials (inputs, outputs and connected-service data) are used to train AI models. Google Workspace data and Vault items are excluded. | Not stated Neither the privacy policy nor the Terms gives any retention period for messages, outputs, connector data, action records or logs. | Not stated No zero data retention option is mentioned. |
| Meta (Meta AI, Muse) | Meta AI (assistant across Meta apps) Consumer app | Stated Yes. Your Meta AI interactions and public posts are used to develop and improve AI at Meta. Private messages with friends aren't used unless someone shares them with the AI. | Stated No fixed period. Meta keeps information as long as it needs it, decided case by case; the AI Terms say AIs 'sometimes retain and use' what you share. | Not stated The captured policies describe no zero-data-retention option for Meta AI. (Private Processing limits Meta's access to some chats but is not described as a retention setting.) |
| Meta (Meta AI, Muse) | Muse (Meta's personal AI agent) Agent | Stated Yes. 'Help improve our AI models' is on when you first use Muse. Meta says it removes some identifiers (names, emails, phone numbers, SSNs) and disassociates interactions from your account. | Stated Muse stores interactions (including voice, photos and connector data used in tasks), goals, artifacts, uploaded files, reminders, memories and its Soul/Identity files. No retention period is stated. | Not stated No zero-data-retention option is described for Muse. |
| Microsoft (Azure OpenAI/Foundry, Copilot) | Azure OpenAI / Foundry Models sold by Azure API | Stated No. Prompts, completions, embeddings and training data aren't used to train foundation models or improve Microsoft or third-party products without your permission, and aren't shared with OpenAI. | Stated Plain inference is stateless and stores nothing in the model. Optional features (Responses API, Assistants Threads, Stored completions, Files) keep data in your resource until you delete it. | Stated Managed customers can apply for modified abuse monitoring. If approved, nothing is stored for human abuse review, though automated review may still run. ContentLogging=false confirms it. |
| Microsoft (Azure OpenAI/Foundry, Copilot) | Microsoft 365 Copilot (work/school accounts) Business | Stated No. Prompts, responses and Microsoft Graph data aren't used to train foundation LLMs. | Stated Prompts, responses and citations are stored as Copilot activity history under the same contractual commitments as your org's other Microsoft 365 content. No default retention period is stated. | Inferred No zero-retention option is described. Inferred from the page saying interactions are stored as activity history by default. |
| Microsoft (Azure OpenAI/Foundry, Copilot) | Microsoft Copilot (consumer website and apps, personal Microsoft account) Consumer app | Stated Microsoft may use data to train AI models, and Copilot uses prompts to improve services. Whether Copilot chats are trained on by default isn't stated. Copilot Health is excluded. | Stated No Copilot-specific retention period. The privacy statement says data is kept as long as necessary for the service and other legitimate purposes, and periods vary widely. | Not stated No zero-retention option is described for consumer Copilot. |
| Mistral (Le Chat, La Plateforme) | Vibe (Mistral's chat assistant app, including Chat and Vibe Work), individual use Consumer app | Inferred Inferred yes: an opt-out exists, and the legal-bases table lists inputs and outputs for training 'subject to your opt-out'. Feedback is listed without that qualifier. | Stated Inputs and outputs are kept until you delete the conversation or your account, so your chat history stays visible. | Stated Not available for Vibe Work or Chat on any plan, because Mistral stores data for conversation history and app state. |
| Mistral (Le Chat, La Plateforme) | Mistral AI Studio APIs (pay-as-you-go and free mode; includes Vibe CLI calls) API | Inferred Not stated for the API. The policy lists inputs and outputs for training 'subject to your opt-out', covering 'eligible data' (undefined), so API data may be used unless opted out. | Stated Most APIs: kept while generating, then 30 rolling days for abuse monitoring. Agents API: until account termination. Fine-tuning data: until deleted. Files API stores uploads (no period given). | Stated Pay-as-you-go only, stateless endpoints only (chat, FIM, embeddings, moderation, OCR, audio). Request via support with your reasons; Mistral approves at its discretion. Agents, batch, files excluded. |
| Mistral (Le Chat, La Plateforme) | Vibe Team and Enterprise plans, and other business use (Mistral as data processor) Business | Not stated Not stated for Team or Enterprise plans. Likely in the Commercial Terms or DPA, which were not captured. | Stated No default period is given. Your organization may set its own retention controls, and business processing falls under the DPA rather than the Privacy Policy. | Stated Not available for Vibe Work or Chat on any plan. For API use, ZDR requires pay-as-you-go and covers stateless endpoints only. |
| OpenAI | ChatGPT (Free, Go, Plus, Pro personal plans) Consumer app | Stated Yes for Free, Plus and Pro (Go isn't named): data sharing ('Improve the model for everyone') is on by default, so chats and remembered information may train models. | Stated Saved chats are kept until you delete them; no maximum period is stated. Temporary Chats stay out of history but may be kept up to 30 days for safety. | Not stated The captured policies describe no zero-data-retention option for personal ChatGPT plans; ZDR appears only for the API. |
| OpenAI | ChatGPT Business, Enterprise, Edu, for Healthcare, and for Teachers Business | Stated No. Business, Enterprise, Edu, Healthcare and Teachers content, including data accessed through apps, isn't used for training by default unless the customer explicitly agrees. | Stated Enterprise, Edu and Healthcare admins set retention; Business admins can control it; in ChatGPT for Teachers each member decides. No default period is stated. | Not stated The captured policies describe no zero-data-retention option for ChatGPT workspaces; admin-controlled retention is the stated control. |
| OpenAI | OpenAI API Platform API | Stated No. Since March 1, 2023, API data isn't used to train or improve models unless the customer explicitly opts in. | Stated Abuse-monitoring logs (may include prompts and outputs) kept up to 30 days. App state varies: Responses at least 30 days by default; Conversations, Assistants, fine-tuning files kept until deleted. | Stated Yes, with prior OpenAI approval via sales. Removes content from abuse logs and forces store=false; ineligible endpoints still keep app state; OpenAI may exclude models with written notice. |
| OpenAI | Dots (always-on agent in ChatGPT) Agent | Inferred Business/Enterprise/Edu: no. Personal plans follow 'Improve the model for everyone', which ChatGPT says is on by default for Free/Plus/Pro, so inferred yes, including actions and connected-app data. | Stated A dot keeps context from your conversations and plugins for as long as you keep the dot. Its context excludes credentials, images and screenshots; files elsewhere follow that location's rules. | Not stated The dots FAQ describes no zero-data-retention option. |
| OpenRouter | OpenRouter API and chat (self-serve accounts) API | Stated OpenRouter does not train on your inputs or outputs. Letting it use them to improve the product is opt-in, for a 1% discount. Upstream providers may train under their policies. | Stated OpenRouter stores no prompts or responses by default, only request metadata (retention period not stated). Opted-in Input & Output Logging keeps content at least 3 months, possibly longer. | Stated Any account can enforce ZDR globally, per model group, per guardrail, or per request. It limits routing to about 1,100 listed endpoints; self-serve default also allows Safety Retention endpoints. |
| OpenRouter | OpenRouter Business / Enterprise (organizations under the DPA) Enterprise | Stated OpenRouter doesn't train on inputs or outputs. With a DPA, provider training limits come from the DPA and OpenRouter's agreements with providers. EU API payloads aren't trained on unless instructed. | Stated Under the DPA, inputs and outputs are deleted promptly after the output is generated, unless the customer opted into prompt/chat logging. Other personal data is kept as long as necessary. | Stated The DPA defines ZDR and commits to ZDR-only routing when enabled. Enterprise accounts default to ZDR only, so Safety Retention endpoints are excluded. Provider compliance isn't guaranteed. |
| Town | Town assistant (Townie), individual and Team plans under the standard Terms Agent | Stated The pages conflict. The docs say Town's training is off by default (opt-in), but the privacy policy says Town may train its models (opt-out). Google data is never used. | Stated No fixed period: personal information is kept while you have an account, plus an unspecified time after. Email and file content isn't stored 'beyond what's necessary' (undefined). | Not stated The captured policies describe no zero-data-retention option for Town's own storage. |
| Town | Town for Organizations (Enterprise Agreement / DPA customers) Enterprise | Stated The default for organizations isn't stated. An Organization's training opt-out overrides each member's own setting. Google Workspace data is never used for training. | Not stated Not stated in the captured policies. Business-customer data falls outside the privacy policy and is governed by the customer agreement, which isn't captured. | Not stated No zero-data-retention offering is described for organizations. |
| Typesafe (Jev) | Jev API and Playground API | Stated No training. The privacy policy says TypeSafe won't train or fine-tune models on prompts or other Input. It says nothing about outputs; only the enterprise page mentions outputs. | Stated No fixed period. The privacy policy keeps data as long as reasonably needed for the Services or business purposes; the DPA keeps customer personal data 'as long as necessary'. | Inferred Inferred: ZDR is offered only to enterprise customers, so standard API and Playground users apparently don't get it. Neither the captured policies nor the DPA say this outright. |
| Typesafe (Jev) | Jev for Enterprise Enterprise | Stated No training. TypeSafe says it won't train or fine-tune models on prompts or other Input; the enterprise FAQ also says outputs aren't used for training. | Stated No fixed period. The privacy policy keeps data as long as reasonably needed for the Services or business purposes; the DPA keeps customer personal data 'as long as necessary'. | Stated Zero data retention is available to enterprise customers on request. The enterprise page links it to the DPA, but the DPA never mentions ZDR, so eligibility and scope remain undescribed. |
| xAI (Grok, Grok Bot) | Grok (grok.com and Grok iOS/Android apps) Consumer app | Inferred Inferred: yes. xAI may train on prompts and responses, and the control is an opt-out toggle. Logged-out users in some non-EU/UK regions can't opt out. | Stated Conversations stay in your account until you delete them. The policy says data is kept while there is a 'legitimate business need' and gives no fixed period. | Inferred Inferred: zero data retention appears only for the business API. The closest consumer option, Private Chat, still keeps conversations up to 30 days. |
| xAI (Grok, Grok Bot) | Grok on X (governed by X Corp. terms and privacy policy) Consumer app | Inferred Inferred: yes. X may share your public data and Grok inputs and results with xAI for training, and the control is an opt-out setting. | Inferred Inferred: X keeps 'usage information' for the life of your account or until removed. It doesn't say this covers Grok chats. xAI's retention of shared data: not stated. | Not stated Not stated. The X captured policies describe no zero-retention option for Grok on X. |
| xAI (Grok, Grok Bot) | xAI API (Enterprise Terms, DPA) API | Stated No. Business inputs and outputs aren't used for training, 'subject to disclosures to Customer and Customer-controlled user settings'. Some customers trade training rights for free credits. | Stated Inputs and outputs are deleted automatically no later than 30 days after the session ends, unless a different period is agreed or set in self-service tools. | Stated Opt-in ZDR-Enabled APIs delete content on delivery or within an hour, with no logs or backups, even for legal needs. Personal data and PHI (plus a BAA) must use ZDR. |
| xAI (Grok, Grok Bot) | Grok Business / Grok Enterprise Enterprise | Stated No. Business user content isn't used to train models, subject to disclosures and customer-controlled settings. The consumer FAQ also says business and enterprise content isn't used to improve models. | Inferred Inferred: the Enterprise Terms cover 'related SpaceXSI Services (including Grok)' for businesses, so the 30-day auto-deletion likely applies. No Grok Business-specific retention page was captured. | Inferred Inferred: ZDR is defined only as 'ZDR-Enabled APIs'. The captured policies don't say whether Grok Business or Enterprise workspaces can use it. |
| xAI (Grok, Grok Bot) | Grok Bot (AI teammate in X Chat) Agent | Inferred Inferred: Grok Bot chats in X Chat may be used for training. The control is an X opt-out setting, but the default is never stated. | Stated Your data is kept for the life of your Grok Bot account unless you delete it. | Not stated Not stated. |
"Not stated" means none of the captured policy pages answers the question, not that the practice is absent. Each provider page has all 16 questions, the quotes behind every answer, and the open questions.