gjalla logogjalla
Talk to us

AI data policies

OpenAI

What OpenAI keeps, for how long, whether it trains on it, and what rights you grant, for ChatGPT (Free, Go, Plus, Pro personal plans), ChatGPT Business, Enterprise, Edu, for Healthcare, and for Teachers, OpenAI API Platform, Dots (always-on agent in ChatGPT). Each answer quotes OpenAI's own policy.

Type Model maker Policies captured 2026-11-08 9 documents read How this is made

ChatGPT (Free, Go, Plus, Pro personal plans) Consumer app

Default retention How long prompts and chats are kept

Stated Saved chats are kept until you delete them; no maximum period is stated. Temporary Chats stay out of history but may be kept up to 30 days for safety.

What the policies say (3 quotes)

"**Information we retain until you delete it:** Some of our Services allow you to delete Personal Data stored in your account."

Privacy policyopenai.comcaptured 2026-11-08

"We’ll retain your Personal Data for only as long as we need in order to provide our Services to you, or for other legitimate business purposes such as resolving disputes, safety and security reasons, or complying with our legal obligations."

Privacy policyopenai.comcaptured 2026-11-08

"may be retained for up to 30 days for safety purposes"

Help data controlshelp.openai.comcaptured 2026-11-08
After you delete How long until it is gone

Stated Deleted chats, memories or accounts are removed within 30 days, except data kept for listed reasons or already de-identified and disassociated for model training. Deleted-memory logs may persist 30 days.

What the policies say (3 quotes)

"Once you choose to delete Personal Data, we will remove it from our systems within 30 days unless we need to retain it for longer as described below, or it has already been de-identified and disassociated from your account when you allow us to use your Content to"

Privacy policyopenai.comcaptured 2026-11-08

"When you delete a chat (or your account), the chat is removed from your account immediately and scheduled for permanent deletion from OpenAI systems within 30 days, unless we are required to retain it for legal or security reasons"

How we\u2019re responding to The New York Times\u2019 data demands in order to protect user privacyopenai.comcaptured 2026-11-08

"OpenAI may retain logs of deleted saved memories for up to 30 days for safety and debugging purposes."

Help memory faqhelp.openai.comcaptured 2026-11-08
Kept longer when Safety flags, legal holds, backups

Stated Kept longer: banned content (no duration given), legally required data, payment records, erasure audit logs. The NYT order ended Sept 26, 2025, but some April–Sept 2025 data remains held.

What the policies say (6 quotes)

"we may retain that data for to protect our services from fraud, abuse, or other violations of our policies"

Privacy policyopenai.comcaptured 2026-11-08

"If we are legally required to retain your data (for instance, we receive a lawful subpoena) then we may retain it for the duration of the relevant legal or regulatory obligation"

Privacy policyopenai.comcaptured 2026-11-08

"we may retain payment and transaction related information to meet our accounting, dispute resolution, and regulatory compliance purposes"

Privacy policyopenai.comcaptured 2026-11-08

"When you ask us to delete your Personal Data, we retain the audit record of the erasure request to be able to verify that we have complied with the request."

Privacy policyopenai.comcaptured 2026-11-08

"After months of litigation, we are no longer under a legal order to retain consumer ChatGPT and API content indefinitely. Our obligations under the earlier order ended on September 26, 2025."

How we\u2019re responding to The New York Times\u2019 data demands in order to protect user privacyopenai.comcaptured 2026-11-08

"we will securely store limited historical April–September 2025 user data. It remains locked down, accessible only to a small, audited OpenAI legal and security team, and can’t be used for anything other than meeting legal obligations."

How we\u2019re responding to The New York Times\u2019 data demands in order to protect user privacyopenai.comcaptured 2026-11-08
Zero data retention Whether it exists and who can get it

Not stated The captured policies describe no zero-data-retention option for personal ChatGPT plans; ZDR appears only for the API.

Trains on your data By default

Stated Yes for Free, Plus and Pro (Go isn't named): data sharing ('Improve the model for everyone') is on by default, so chats and remembered information may train models.

What the policies say (3 quotes)

"On personal workspaces with ChatGPT Free, Plus, or Pro, data sharing is enabled by default."

Help data controlshelp.openai.comcaptured 2026-11-08

"As noted above, we may use Content you provide us to improve our Services, for example to train the models that power ChatGPT."

Privacy policyopenai.comcaptured 2026-11-08

"For personal ChatGPT accounts, OpenAI may use chats and remembered information to improve models when **Improve the model for everyone** is on."

Help memory faqhelp.openai.comcaptured 2026-11-08
Opting out How, and what it doesn't cover

Stated Turn off 'Improve the model for everyone' in Data controls. Not covered: thumbs-up/down feedback (whole conversation), Daybreak Trusted Access sessions, and voice mode and Codex environments (separate toggles).

What the policies say (6 quotes)

"You can turn off **Improve the model for everyone** and keep your chat history."

Help data controlshelp.openai.comcaptured 2026-11-08

"If you choose to provide feedback, such as selecting thumbs up or thumbs down on a response, the entire conversation associated with that feedback may be used to train OpenAI models."

Help data controlshelp.openai.comcaptured 2026-11-08

"During Daybreak sessions on your personal account, we may use content from your interactions to improve our models even when “Improve the model for everyone” is off."

Help data controlshelp.openai.comcaptured 2026-11-08

"Voice mode has a separate control for sharing data for model training."

Help data controlshelp.openai.comcaptured 2026-11-08

"Changing your ChatGPT setting or opting out through the Privacy Portal does not change that setting."

Help data controlshelp.openai.comcaptured 2026-11-08

"When using ChatGPT without signing in, open Settings and turn off Improve the model for everyone. Your choice is saved in that browser."

Help data controlshelp.openai.comcaptured 2026-11-08
Human review Whether people read conversations

Inferred Inferred: OpenAI says it monitors submitted Content for misuse and uses ChatGPT user data with human trainers, but the captured policies don't say when staff read consumer chats.

What the policies say (2 quotes)

"To prevent fraud, illegal activity, or misuses of our Services, and to protect the security of our systems and Services, including by monitoring any Content submitted or exchanged on our platforms"

Privacy policyopenai.comcaptured 2026-11-08

"Then, we use data from ChatGPT users and human trainers to make sure the outputs are safe and accurate and to improve their general capabilities."

Enterprise privacyopenai.comcaptured 2026-11-08
Memory Remembered facts and profiles

Stated Memory uses past chats, saved memories, files and connected apps. Review via summary; delete saved memories separately from chats. Chat-history memory deleted within 30 days when turned off.

What the policies say (5 quotes)

"The memory summary is a high-level view of information that ChatGPT may use to personalize responses. It does not necessarily include every detail or source that Memory can reference."

Help memory faqhelp.openai.comcaptured 2026-11-08

"Saved memories are stored separately from chat history. Deleting the original chat does not automatically delete a separate saved memory."

Help memory faqhelp.openai.comcaptured 2026-11-08

"If you turn **Reference chat history** off, information remembered from past chats is scheduled for deletion from OpenAI systems within 30 days."

Help memory faqhelp.openai.comcaptured 2026-11-08

"OpenAI may retain logs of deleted saved memories for up to 30 days for safety and debugging purposes."

Help memory faqhelp.openai.comcaptured 2026-11-08

"Temporary chats do not create or update memories, even with personalization on."

Help memory faqhelp.openai.comcaptured 2026-11-08
Connected apps Email, calendar, drive

Stated Connected-service data is collected as Content and can feed Memory. Disconnecting stops future access but doesn't delete past conversations that used it; how long app data is stored isn't stated.

What the policies say (3 quotes)

"and data from [*connected services*"

Privacy policyopenai.comcaptured 2026-11-08

"content from connected apps, such as Gmail"

Help memory faqhelp.openai.comcaptured 2026-11-08

"Disconnecting an app prevents future access to that app. It does not delete past conversations that already used app content."

Help memory faqhelp.openai.comcaptured 2026-11-08
Agent actions Actions taken, browsing, credentials

Stated The privacy policy says OpenAI may collect in-app browser data per your controls. Captured policies don't describe ChatGPT agent action logs or stored tokens (see the Dots product).

What the policy says

"If you use the in-app browser we may also collect your browser data according to your controls and use of the service."

Privacy policyopenai.comcaptured 2026-11-08
Your inputs Who owns them

Stated You keep your ownership rights in what you input, as between you and OpenAI and where the law allows.

What the policy says

"As between you and OpenAI, and to the extent permitted by applicable law, you (a) retain your ownership rights in Input and (b) own the Output."

Terms of useopenai.comcaptured 2026-11-08
Outputs Who owns them

Stated You own outputs and OpenAI assigns you any rights it has; similar outputs given to other users aren't covered.

What the policies say (2 quotes)

"We hereby assign to you all our right, title, and interest, if any, in and to Output."

Terms of useopenai.comcaptured 2026-11-08

"Our assignment above does not extend to other users’ output or any Third Party Output."

Terms of useopenai.comcaptured 2026-11-08
License you grant Scope, and whether it is perpetual

Stated No formal license clause: OpenAI may use Content to run, develop and improve services. Duration, revocability and survival aren't stated. Feedback may be used without restriction.

What the policies say (2 quotes)

"We may use Content to provide, maintain, develop, and improve our Services, comply with applicable law, enforce our terms and policies, and keep our Services safe."

Terms of useopenai.comcaptured 2026-11-08

"We appreciate your feedback, and you agree that we may use it without restriction or compensation to you."

Terms of useopenai.comcaptured 2026-11-08
Sharing Model providers, subprocessors, ads

Stated Shared with vendors, affiliates, authorities and marketing partners (ads on other sites, opt-out available). OpenAI says it doesn't 'sell' data. Free and Go users get personalized ads.

What the policies say (4 quotes)

"When we work with Service Providers, these parties will access, process, or store Personal Data based on our instructions and only in the course of performing their duties to us."

Privacy policyopenai.comcaptured 2026-11-08

"We don’t “sell” Personal Data. Depending upon your choices, we may share limited data with select marketing partners for purposes of promoting our products and services to you on third-party properties."

Privacy policyopenai.comcaptured 2026-11-08

"For Free and Go users, to personalize the ads you see on our Services (subject to your settings), and to measure the effectiveness of ads shown on our Services."

Privacy policyopenai.comcaptured 2026-11-08

"Information you share with third-party partners is governed by their own terms and privacy policies"

Privacy policyopenai.comcaptured 2026-11-08
Where data lives Regions and residency

Stated Processed and stored in the US and wherever affiliates, partners or vendors are. No consumer residency option is described; EEA, UK and Swiss users have a separate policy.

What the policies say (2 quotes)

"including processing and storing your Personal Data in our facilities and servers in the United States, or in countries or territories where our affiliates and partners or our vendors and service providers are located."

Privacy policyopenai.comcaptured 2026-11-08

"For individuals in the European Economic Area, United Kingdom, and Switzerland, you can read"

Privacy policyopenai.comcaptured 2026-11-08
Enterprise controls Retention settings, DPA, SSO

Not stated Not applicable to personal plans; see the chatgpt-business product.

ChatGPT Business, Enterprise, Edu, for Healthcare, and for Teachers Business

Default retention How long prompts and chats are kept

Stated Enterprise, Edu and Healthcare admins set retention; Business admins can control it; in ChatGPT for Teachers each member decides. No default period is stated.

What the policies say (4 quotes)

"Your workspace admins control how long your data is retained."

Enterprise privacyopenai.comcaptured 2026-11-08

"Your workspace admins can control how long your data is retained."

Enterprise privacyopenai.comcaptured 2026-11-08

"Each of your workspace members control whether their conversations are retained."

Enterprise privacyopenai.comcaptured 2026-11-08

"Managed workspaces can also have organization-level retention, Memory, compliance, and access settings."

Help data controlshelp.openai.comcaptured 2026-11-08
After you delete How long until it is gone

Stated Deleted conversations (and, for Business, unsaved ones) are removed within 30 days. On contract termination all Customer Content is deleted within 30 days. Account deletion goes through the workspace owner.

What the policies say (4 quotes)

"Any deleted conversations are removed from our systems within 30 days, unless we are legally required to retain them."

Enterprise privacyopenai.comcaptured 2026-11-08

"Any deleted or unsaved conversations are removed from our systems within 30 days, unless longer retention is required by law, or is reasonably necessary to protect our services or any third party from harm."

Enterprise privacyopenai.comcaptured 2026-11-08

"OpenAI will delete all Customer Content from its systems within thirty days, unless: (i) OpenAI is legally required to retain it; or (ii) Customer has agreed otherwise in writing."

Services agreementopenai.comcaptured 2026-11-08

"Self-service account deletion is not available in managed workspaces and should be directed to the workspace owner."

Help data controlshelp.openai.comcaptured 2026-11-08
Kept longer when Safety flags, legal holds, backups

Stated Legal requirements; for Business, also harm prevention; abusive content may be kept. Classifier metadata is created (duration unstated). The past NYT order covered Team but excluded Enterprise and Edu.

What the policies say (5 quotes)

"Despite anything to the contrary in this Agreement, OpenAI may retain Abusive Customer Content"

Services agreementopenai.comcaptured 2026-11-08

"We may run any business data submitted to OpenAI’s services through automated content classifiers and safety tools, including to better understand how our services are used. The classifications created are metadata about the business data but do not contain any of the business data itself."

Enterprise privacyopenai.comcaptured 2026-11-08

"Yes, if you have a ChatGPT Free, Plus, Pro, and Team subscription or if you use the OpenAI API (without a Zero Data Retention agreement)."

How we\u2019re responding to The New York Times\u2019 data demands in order to protect user privacyopenai.comcaptured 2026-11-08

"This does *not* impact ChatGPT Enterprise or ChatGPT Edu customers."

How we\u2019re responding to The New York Times\u2019 data demands in order to protect user privacyopenai.comcaptured 2026-11-08

"Our obligations under the earlier order ended on September 26, 2025."

How we\u2019re responding to The New York Times\u2019 data demands in order to protect user privacyopenai.comcaptured 2026-11-08
Zero data retention Whether it exists and who can get it

Not stated The captured policies describe no zero-data-retention option for ChatGPT workspaces; admin-controlled retention is the stated control.

Trains on your data By default

Stated No. Business, Enterprise, Edu, Healthcare and Teachers content, including data accessed through apps, isn't used for training by default unless the customer explicitly agrees.

What the policies say (4 quotes)

"By default, OpenAI does not use content from ChatGPT Business, Enterprise, Edu, or ChatGPT for Healthcare workspaces to train its models."

Help data controlshelp.openai.comcaptured 2026-11-08

"As with our Enterprise, Business, and Edu offerings, information shared with ChatGPT for Teachers is not used to train our models by default."

Enterprise privacyopenai.comcaptured 2026-11-08

"By default, we do not train our models on any data accessed from apps."

Enterprise privacyopenai.comcaptured 2026-11-08

"OpenAI will not use Customer Content to develop or improve the Services, unless Customer explicitly agrees to such use."

Services agreementopenai.comcaptured 2026-11-08
Opting out How, and what it doesn't cover

Stated Nothing to opt out of: training happens only after an explicit opt-in, e.g. feedback mechanisms. The captured policies don't say whether an end user's thumbs-up counts as opt-in.

What the policies say (2 quotes)

"If you have explicitly opted in to share your data with us"

Enterprise privacyopenai.comcaptured 2026-11-08

"then we may use the shared data to train our models."

Enterprise privacyopenai.comcaptured 2026-11-08
Human review Whether people read conversations

Stated Automated classifiers scan business data. Enterprise/Edu/Healthcare: staff access only for incidents, permitted recovery, or law. Business/Teachers: staff for support, abuse, legal, plus contracted abuse reviewers.

What the policies say (3 quotes)

"Business data is only subject to human review as described below on a service-by-service basis."

Enterprise privacyopenai.comcaptured 2026-11-08

"Authorized OpenAI employees will only ever access your conversations for the purposes of resolving incidents, recovering end user conversations with your explicit permission, or where required by applicable law."

Enterprise privacyopenai.comcaptured 2026-11-08

"Our access to conversations stored on our systems is limited to (1) authorized employees that require access for engineering support, investigating potential platform abuse, and legal compliance and (2) specialized third-party contractors who are bound by confidentiality and security obligations, solely to review for abuse and misuse."

Enterprise privacyopenai.comcaptured 2026-11-08
Memory Remembered facts and profiles

Stated Admins manage memory settings and role permissions. In Healthcare and Regulated Enterprise workspaces improved memory is off by default and not BAA-covered; Project-only memory can limit scope.

What the policies say (4 quotes)

"Workspace owners and admins can manage supported memory settings and role permissions."

Help memory faqhelp.openai.comcaptured 2026-11-08

"In ChatGPT for Healthcare and ChatGPT Enterprise with Regulated Workspace, improved memory is disabled by default."

Help memory faqhelp.openai.comcaptured 2026-11-08

"This feature is not covered under your BAA. PHI should not be entered when using this feature."

Help memory faqhelp.openai.comcaptured 2026-11-08

"Members who choose to use improved memory can use Project-only memory to keep memory context limited to a specific project."

Help memory faqhelp.openai.comcaptured 2026-11-08
Connected apps Email, calendar, drive

Stated Admins choose which apps are enabled; each user authenticates and existing permissions apply; app data isn't trained on by default. Storage and post-disconnect handling aren't stated.

What the policies say (2 quotes)

"Your workspace admins can control which apps are enabled for your workspace. ChatGPT respects your organization’s existing permissions, and each end user is required to authenticate with a connected application before use."

Enterprise privacyopenai.comcaptured 2026-11-08

"By default, we do not train our models on any data accessed from apps."

Enterprise privacyopenai.comcaptured 2026-11-08
Agent actions Actions taken, browsing, credentials

Not stated The captured policies don't describe agent action logs, browsing sessions or stored tokens for ChatGPT workspaces (dots are covered separately).

Your inputs Who owns them

Stated The customer retains all ownership rights in Input, as between customer and OpenAI and where the law allows.

What the policies say (2 quotes)

"As between Customer and OpenAI, to the extent permitted by applicable law, Customer: (a) retains all ownership rights in Input; and (b) owns all Output."

Services agreementopenai.comcaptured 2026-11-08

"you retain all rights to the inputs you provide to our services"

Enterprise privacyopenai.comcaptured 2026-11-08
Outputs Who owns them

Stated The customer owns all Output and OpenAI assigns its rights; responses generated for other users aren't the customer's Output.

What the policies say (2 quotes)

"OpenAI hereby assigns to Customer all OpenAI’s right, title, and interest, if any, in and to Output."

Services agreementopenai.comcaptured 2026-11-08

"Responses that are requested by and generated for other users are not considered Customer’s Output."

Services agreementopenai.comcaptured 2026-11-08
License you grant Scope, and whether it is perpetual

Stated Only limited rights needed to deliver the Services, extended to subprocessors; use limited to service, law, policy and abuse. The IP section survives termination; content is deleted within 30 days.

What the policies say (4 quotes)

"Customer grants OpenAI only the limited rights that are reasonably necessary for OpenAI to deliver the Services. This limited permission also extends to subcontractors or sub-processors."

Services agreementopenai.comcaptured 2026-11-08

"OpenAI will only use Customer Content as necessary to provide Customer with the Services, comply with applicable law, enforce the OpenAI Policies, and prevent abuse."

Services agreementopenai.comcaptured 2026-11-08

"The following provisions will survive termination or expiration of the Agreement: 6.2 (Payment), 7 (Confidentiality), 9 (IP Rights)"

Services agreementopenai.comcaptured 2026-11-08

"If Customer provides Feedback, Customer grants OpenAI the right to use and exploit Feedback without restriction or compensation."

Services agreementopenai.comcaptured 2026-11-08
Sharing Model providers, subprocessors, ads

Stated Workspace admins can access members' content. Subprocessors get limited rights; Business and Teachers conversations may go to contracted abuse reviewers. Ads aren't mentioned for business plans.

What the policies say (3 quotes)

"When you join a ChatGPT Enterprise or business account, the administrators of that account may access and control your OpenAI account, including being able to access your Content."

Privacy policyopenai.comcaptured 2026-11-08

"Workspace admins have control over workspaces and can view, access, export, and delete end user conversations in the workspace."

Enterprise privacyopenai.comcaptured 2026-11-08

"This limited permission also extends to subcontractors or sub-processors."

Services agreementopenai.comcaptured 2026-11-08
Where data lives Regions and residency

Inferred Inferred: the captured policies link to a ChatGPT data residency and inference residency article, so regional options appear to exist, but no regions or eligibility rules are given.

What the policies say (2 quotes)

"Learn how ChatGPT data residency and inference residency affect storage, model processing, eligibility, and supported regions."

Help data controlshelp.openai.comcaptured 2026-11-08

"For supported storage and inference regions, see"

Dots privacy faqhelp.openai.comcaptured 2026-11-08
Enterprise controls Retention settings, DPA, SSO

Stated SAML SSO, fine-grained access, admin-set retention, Compliance API audit logs (Enterprise/Edu/Healthcare), DPA (Business/Enterprise), Student Data Privacy Agreement (Edu/Teachers), SOC 2 Type 2; exports via workspace owner.

What the policies say (6 quotes)

"Enterprise-level authentication through SAML SSO"

Enterprise privacyopenai.comcaptured 2026-11-08

"workspace admins can access an audit log of conversations and GPTs through the"

Enterprise privacyopenai.comcaptured 2026-11-08

"we are able to execute a Data Processing Addendum (DPA) with customers for their use of ChatGPT Business, ChatGPT Enterprise, and the API in support of their compliance with GDPR and other privacy laws."

Enterprise privacyopenai.comcaptured 2026-11-08

"For ChatGPT Edu and for Teachers, we process your data pursuant to our"

Enterprise privacyopenai.comcaptured 2026-11-08

"They’ve each successfully completed a SOC 2 Type 2 audit."

Enterprise privacyopenai.comcaptured 2026-11-08

"Self-service data export is not available for ChatGPT Business, Enterprise, or ChatGPT for Healthcare workspaces and should be directed to the workspace owner."

Help data controlshelp.openai.comcaptured 2026-11-08

OpenAI API Platform API

Default retention How long prompts and chats are kept

Stated Abuse-monitoring logs (may include prompts and outputs) kept up to 30 days. App state varies: Responses at least 30 days by default; Conversations, Assistants, fine-tuning files kept until deleted.

What the policies say (5 quotes)

"Abuse monitoring logs may contain certain customer content, such as prompts and responses, as well as metadata derived from that customer content, such as classifier outputs. By default, abuse monitoring logs are generated for all API feature usage and retained for up to 30 days"

Data controls in the OpenAI platformdevelopers.openai.comcaptured 2026-11-08

"Except as noted below, the Responses API has a 30 day Application State retention period by default, or when the `store` parameter is set to `true`. In those cases, response data will be stored for at least 30 days."

Data controls in the OpenAI platformdevelopers.openai.comcaptured 2026-11-08

"/v1/conversations \| No \| Until deleted \| Until deleted"

Data controls in the OpenAI platformdevelopers.openai.comcaptured 2026-11-08

"Objects that are not deleted via the API or dashboard are retained indefinitely."

Data controls in the OpenAI platformdevelopers.openai.comcaptured 2026-11-08

"Data submitted to fine-tune a model is retained until the customer deletes the files."

Enterprise privacyopenai.comcaptured 2026-11-08
After you delete How long until it is gone

Stated Assistants objects are deleted 30 days after you delete them; all Customer Content within 30 days of termination. Live session recordings can't be deleted; they expire after 30 days.

What the policies say (4 quotes)

"Objects related to the Assistants API are deleted from our servers 30 days after you delete them via the API or the dashboard."

Data controls in the OpenAI platformdevelopers.openai.comcaptured 2026-11-08

"OpenAI will delete all Customer Content from its systems within thirty days, unless: (i) OpenAI is legally required to retain it; or (ii) Customer has agreed otherwise in writing."

Services agreementopenai.comcaptured 2026-11-08

"The API does not provide a public stored-session deletion endpoint."

Data controls in the OpenAI platformdevelopers.openai.comcaptured 2026-11-08

"Stored sessions and their index expire after 30 days."

Data controls in the OpenAI platformdevelopers.openai.comcaptured 2026-11-08
Kept longer when Safety flags, legal holds, backups

Stated Kept longer if legally required or to prevent harm. Suspected CSAM images kept for review even under ZDR; Safety Retention may keep flagged content. NYT order ended Sept 26, 2025.

What the policies say (5 quotes)

"unless longer retention is required by law, or is reasonably necessary to protect our services or any third party from harm."

Data controls in the OpenAI platformdevelopers.openai.comcaptured 2026-11-08

"If the classifier detects potential CSAM content, the image will be retained for manual review, even if Zero Data Retention, Modified Abuse Monitoring, or Private Retention with PSP is enabled."

Data controls in the OpenAI platformdevelopers.openai.comcaptured 2026-11-08

"In this instance, we may retain and human review customer content when using these models that our classifiers detect as potentially violating our"

Data controls in the OpenAI platformdevelopers.openai.comcaptured 2026-11-08

"Yes, if you have a ChatGPT Free, Plus, Pro, and Team subscription or if you use the OpenAI API (without a Zero Data Retention agreement)."

How we\u2019re responding to The New York Times\u2019 data demands in order to protect user privacyopenai.comcaptured 2026-11-08

"After months of litigation, we are no longer under a legal order to retain consumer ChatGPT and API content indefinitely. Our obligations under the earlier order ended on September 26, 2025."

How we\u2019re responding to The New York Times\u2019 data demands in order to protect user privacyopenai.comcaptured 2026-11-08
Zero data retention Whether it exists and who can get it

Stated Yes, with prior OpenAI approval via sales. Removes content from abuse logs and forces store=false; ineligible endpoints still keep app state; OpenAI may exclude models with written notice.

What the policies say (5 quotes)

"Currently, these controls are subject to prior approval by OpenAI and acceptance of additional requirements."

Data controls in the OpenAI platformdevelopers.openai.comcaptured 2026-11-08

"You can also request zero data retention (ZDR) for eligible endpoints if you have a qualifying use-case."

Enterprise privacyopenai.comcaptured 2026-11-08

"Additionally, Zero Data Retention changes some endpoint behavior: the `store` parameter for `/v1/responses` and `v1/chat/completions` will always be treated as `false`, even if the request attempts to set the value to `true`."

Data controls in the OpenAI platformdevelopers.openai.comcaptured 2026-11-08

"Zero Data Retention ineligible endpoints or capabilities may retain application state when used, even if you have Zero Data Retention enabled."

Data controls in the OpenAI platformdevelopers.openai.comcaptured 2026-11-08

"we reserve the right to make models ineligible for Zero Data Retention or Modified Abuse Monitoring for specific customers, as notified in advance to the impacted customers in writing."

Data controls in the OpenAI platformdevelopers.openai.comcaptured 2026-11-08
Trains on your data By default

Stated No. Since March 1, 2023, API data isn't used to train or improve models unless the customer explicitly opts in.

What the policies say (2 quotes)

"As of March 1, 2023, data sent to the OpenAI API is not used to train or improve OpenAI models (unless you explicitly opt in to share data with us)."

Data controls in the OpenAI platformdevelopers.openai.comcaptured 2026-11-08

"OpenAI will not use Customer Content to develop or improve the Services, unless Customer explicitly agrees to such use."

Services agreementopenai.comcaptured 2026-11-08
Opting out How, and what it doesn't cover

Stated Not needed: training is opt-in only, for example via feedback-sharing mechanisms. The captured policies don't describe how to withdraw an opt-in.

What the policies say (2 quotes)

"If you have explicitly opted in to share your data with us"

Enterprise privacyopenai.comcaptured 2026-11-08

"then we may use the shared data to train our models."

Enterprise privacyopenai.comcaptured 2026-11-08
Human review Whether people read conversations

Stated Staff (engineering, abuse, legal) and contracted abuse reviewers can access stored API data. Safety Retention allows human review of flagged content; Private Retention excludes it unless law requires.

What the policies say (3 quotes)

"Our access to API business data stored on our systems is limited to (1) authorized employees that require access for engineering support, investigating potential platform abuse, and legal compliance and (2) specialized third-party contractors who are bound by confidentiality and security obligations, solely to review for abuse and misuse."

Enterprise privacyopenai.comcaptured 2026-11-08

"In this instance, we may retain and human review customer content when using these models that our classifiers detect as potentially violating our"

Data controls in the OpenAI platformdevelopers.openai.comcaptured 2026-11-08

"but such content will be excluded from human review unless required by applicable law."

Data controls in the OpenAI platformdevelopers.openai.comcaptured 2026-11-08
Memory Remembered facts and profiles

Not stated The captured policies describe no memory or user-profile feature for the API; stored Conversations objects are covered under retention.

Connected apps Email, calendar, drive

Stated Data sent to remote MCP servers or other third-party services over the network follows those services' retention and residency policies, not OpenAI's.

What the policies say (2 quotes)

"MCP servers (used with the [remote MCP server tool](/api/docs/guides/tools-remote-mcp)) are third-party services, and data sent to an MCP server is subject to their data retention policies."

Data controls in the OpenAI platformdevelopers.openai.comcaptured 2026-11-08

"Data transmitted to third-party services over network connections is subject to their data retention policies."

Data controls in the OpenAI platformdevelopers.openai.comcaptured 2026-11-08
Agent actions Actions taken, browsing, credentials

Stated Hosted shell, Code Interpreter and hosted skills write temporary container data, deleted when the container expires or is deleted. /v1/agents state is kept until deleted. Computer Use images are CSAM-scanned.

What the policies say (4 quotes)

"Hosted containers used by [Hosted Shell](/api/docs/guides/tools-shell#hosted-shell-quickstart) and [Code Interpreter](/api/docs/guides/tools-code-interpreter) may write temporary application state to the container filesystem (backed by ephemeral block storage) while the container is active. Container data is deleted when the container expires or is explicitly deleted."

Data controls in the OpenAI platformdevelopers.openai.comcaptured 2026-11-08

"/v1/agents \| No \| 30 days \| Until deleted"

Data controls in the OpenAI platformdevelopers.openai.comcaptured 2026-11-08

"Images and files may be uploaded as inputs to `/v1/responses` (including when using the Computer Use tool), `/v1/chat/completions`, and `/v1/images`."

Data controls in the OpenAI platformdevelopers.openai.comcaptured 2026-11-08

"Image and file inputs are scanned for CSAM content upon submission."

Data controls in the OpenAI platformdevelopers.openai.comcaptured 2026-11-08
Your inputs Who owns them

Stated The customer retains all ownership rights in Input, as between customer and OpenAI and where the law allows.

What the policy says

"As between Customer and OpenAI, to the extent permitted by applicable law, Customer: (a) retains all ownership rights in Input; and (b) owns all Output."

Services agreementopenai.comcaptured 2026-11-08
Outputs Who owns them

Stated The customer owns all Output and OpenAI assigns its rights; output generated for other users isn't the customer's.

What the policies say (2 quotes)

"OpenAI hereby assigns to Customer all OpenAI’s right, title, and interest, if any, in and to Output."

Services agreementopenai.comcaptured 2026-11-08

"Responses that are requested by and generated for other users are not considered Customer’s Output."

Services agreementopenai.comcaptured 2026-11-08
License you grant Scope, and whether it is perpetual

Stated Only limited rights needed to deliver the Services, extended to subprocessors; use limited to service, law, policy and abuse. The IP section survives termination. Feedback usable without restriction.

What the policies say (4 quotes)

"Customer grants OpenAI only the limited rights that are reasonably necessary for OpenAI to deliver the Services. This limited permission also extends to subcontractors or sub-processors."

Services agreementopenai.comcaptured 2026-11-08

"OpenAI will only use Customer Content as necessary to provide Customer with the Services, comply with applicable law, enforce the OpenAI Policies, and prevent abuse."

Services agreementopenai.comcaptured 2026-11-08

"The following provisions will survive termination or expiration of the Agreement: 6.2 (Payment), 7 (Confidentiality), 9 (IP Rights)"

Services agreementopenai.comcaptured 2026-11-08

"If Customer provides Feedback, Customer grants OpenAI the right to use and exploit Feedback without restriction or compensation."

Services agreementopenai.comcaptured 2026-11-08
Sharing Model providers, subprocessors, ads

Stated OpenAI uses listed sub-processors; Cloudflare terminates TLS in-region for US/EU endpoints. Data routed to MCP or third-party services follows their terms. Abuse-related information may be shared.

What the policies say (3 quotes)

"OpenAI uses [sub-processors](https://openai.com/policies/sub-processor-list/) to provide its services."

Data controls in the OpenAI platformdevelopers.openai.comcaptured 2026-11-08

"For requests sent to `us.api.openai.com` or `eu.api.openai.com`, OpenAI uses [Cloudflare Regional Services](https://developers.cloudflare.com/data-localization/regional-services/) so that TLS termination and HTTPS decryption occur within the selected processing region."

Data controls in the OpenAI platformdevelopers.openai.comcaptured 2026-11-08

"share information related to Abusive Customer Content, as required by law, or as reasonably necessary to protect the Services or any third party from harm."

Services agreementopenai.comcaptured 2026-11-08
Where data lives Regions and residency

Stated Approved customers can choose a storage region per project; not every region also runs inference there. Non-US regions require MAM/ZDR plus an amendment. System data is excluded; 10% price uplift.

What the policies say (6 quotes)

"Contact our [sales team](https://openai.com/contact-sales) to see if you’re eligible for using data residency controls."

Data controls in the OpenAI platformdevelopers.openai.comcaptured 2026-11-08

"Support for regional storage does not imply support for regional processing."

Data controls in the OpenAI platformdevelopers.openai.comcaptured 2026-11-08

"If your selected Region does not support regional processing, as identified below, OpenAI may also process and temporarily store Customer Content outside of the Region to deliver the services."

Data controls in the OpenAI platformdevelopers.openai.comcaptured 2026-11-08

"To use data residency with any region other than the United States, you must be approved for abuse monitoring controls, and execute a Modified Retention amendment."

Data controls in the OpenAI platformdevelopers.openai.comcaptured 2026-11-08

"Data residency does not apply to system data, which may be processed and stored outside the selected region."

Data controls in the OpenAI platformdevelopers.openai.comcaptured 2026-11-08

"Data residency endpoints are charged a [10% uplift](/api/docs/pricing) for models released on or after March 5, 2026, that are eligible for data residency."

Data controls in the OpenAI platformdevelopers.openai.comcaptured 2026-11-08
Enterprise controls Retention settings, DPA, SSO

Stated Org- and project-level ZDR/Modified Abuse Monitoring settings, data residency, Enterprise Key Management, DPA, BAA for HIPAA, SOC 2 Type 2, and audit reports on request.

What the policies say (6 quotes)

"From that tab, you can configure data retention controls at both the organization and project level."

Data controls in the OpenAI platformdevelopers.openai.comcaptured 2026-11-08

"Enterprise Key Management (EKM) allows you to encrypt your customer content at OpenAI using keys managed by your own external Key Management System (KMS)."

Data controls in the OpenAI platformdevelopers.openai.comcaptured 2026-11-08

"We are able to sign Business Associate Agreements (BAA) in support of customers’ compliance with the Health Insurance Portability and Accountability Act (HIPAA)."

Enterprise privacyopenai.comcaptured 2026-11-08

"we are able to execute a Data Processing Addendum (DPA) with customers for their use of ChatGPT Business, ChatGPT Enterprise, and the API in support of their compliance with GDPR and other privacy laws."

Enterprise privacyopenai.comcaptured 2026-11-08

"Our API Platform has been audited and certified for SOC 2 Type 2 compliance."

Enterprise privacyopenai.comcaptured 2026-11-08

"Upon Customer’s written request, but no more than once per year, OpenAI will provide Customer a copy of the most recent Audit Reports"

Services agreementopenai.comcaptured 2026-11-08

Dots (always-on agent in ChatGPT) Agent

Default retention How long prompts and chats are kept

Stated A dot keeps context from your conversations and plugins for as long as you keep the dot. Its context excludes credentials, images and screenshots; files elsewhere follow that location's rules.

What the policies say (2 quotes)

"Your dot can retain context from your conversations and plugins for as long as you keep your dot."

Dots privacy faqhelp.openai.comcaptured 2026-11-08

"Your dot’s context does not retain credentials, images, or screenshots. Files your dot creates or uses in other locations, such as ChatGPT Library, your computer, or a connected storage service, follow that location’s retention policies."

Dots privacy faqhelp.openai.comcaptured 2026-11-08
After you delete How long until it is gone

Stated Deleting a dot 'starts deletion' of its context; no completion time is stated. Files, Codex threads and ChatGPT conversations it created remain. Pausing or removing access deletes nothing.

What the policies say (4 quotes)

"Deleting your dot starts deletion of its own context."

Dots privacy faqhelp.openai.comcaptured 2026-11-08

"Files, Codex threads, and ChatGPT conversations your dot created are stored separately. Deleting your dot does not delete them."

Dots privacy faqhelp.openai.comcaptured 2026-11-08

"Pausing a dot or removing a member’s permission to use it does not delete the dot’s stored information."

Dots privacy faqhelp.openai.comcaptured 2026-11-08

"Deleting a Library file does not by itself delete a copy already attached to your dot’s conversation."

Dots privacy faqhelp.openai.comcaptured 2026-11-08
Kept longer when Safety flags, legal holds, backups

Not stated The dots FAQ names no legal-hold, safety or backup retention for dot context; whether ChatGPT's exceptions apply isn't stated.

Zero data retention Whether it exists and who can get it

Not stated The dots FAQ describes no zero-data-retention option.

Trains on your data By default

Inferred Business/Enterprise/Edu: no. Personal plans follow 'Improve the model for everyone', which ChatGPT says is on by default for Free/Plus/Pro, so inferred yes, including actions and connected-app data.

What the policies say (4 quotes)

"For ChatGPT Business, Enterprise, and Edu workspaces, we don’t use your data to train our models by default."

Dots privacy faqhelp.openai.comcaptured 2026-11-08

"For personal ChatGPT plans, your “**Improve the model for everyone**” setting controls whether your dots’ conversations and work may be used to improve our models."

Dots privacy faqhelp.openai.comcaptured 2026-11-08

"This may include actions dots take, work they delegate to other agents, automations you set up, and data from connected apps that is used to inform your conversations."

Dots privacy faqhelp.openai.comcaptured 2026-11-08

"On personal workspaces with ChatGPT Free, Plus, or Pro, data sharing is enabled by default."

Help data controlshelp.openai.comcaptured 2026-11-08
Opting out How, and what it doesn't cover

Stated Turn off 'Improve the model for everyone' in ChatGPT settings. Background research notes aren't trained on directly, but research brought into a conversation may be. Identifiers removed 'where possible'.

What the policies say (3 quotes)

"You can turn off “**Improve the model for everyone**” in ChatGPT settings."

Dots privacy faqhelp.openai.comcaptured 2026-11-08

"We don’t train directly on proactive background research or its notes. If a dot brings information from that research into an eligible conversation or task, that information may be used for training, depending on your settings."

Dots privacy faqhelp.openai.comcaptured 2026-11-08

"We take steps to remove personal identifiers where possible before using eligible data."

Dots privacy faqhelp.openai.comcaptured 2026-11-08
Human review Whether people read conversations

Stated Yes: people associated with OpenAI may review dot activity in limited circumstances, including safety cases, even with model improvement off. Automated safety monitoring runs as the dot works.

What the policies say (2 quotes)

"Human review may occur in limited [*circumstances*](https://help.openai.com/articles/7039943#authorized-human-access-to-content), including safety-related cases, even when model improvement is turned off."

Dots privacy faqhelp.openai.comcaptured 2026-11-08

"**Safety monitoring** looks for potentially harmful behavior as your dot works."

Dots privacy faqhelp.openai.comcaptured 2026-11-08
Memory Remembered facts and profiles

Stated Dots and ChatGPT Memory share memories both ways. Individual dot memories can't be viewed, edited or deleted; only deleting the dot does. Turning off Memory stops sharing, keeps received data.

What the policies say (4 quotes)

"Yes. Your dot can receive memories and recent conversation context from ChatGPT, and conversations with your dot can contribute to memory in ChatGPT."

Dots privacy faqhelp.openai.comcaptured 2026-11-08

"Turning off **Memory** in ChatGPT stops that sharing. It does not delete information that your dot has already received."

Dots privacy faqhelp.openai.comcaptured 2026-11-08

"You currently cannot view, delete, or directly modify individual dot memories, including specific details that enter the dot’s context from plugins."

Dots privacy faqhelp.openai.comcaptured 2026-11-08

"Any information that your dot has shared with ChatGPT Memory can be separately managed in ChatGPT Memory settings."

Dots privacy faqhelp.openai.comcaptured 2026-11-08
Connected apps Email, calendar, drive

Stated Dots share plugin connections with ChatGPT, ChatGPT Work and Codex; plugin data enters dot context. Disconnecting stops new access but deletes nothing already absorbed. Proactive research reads connected sources.

What the policies say (4 quotes)

"Plugin permissions are shared across dots, ChatGPT, ChatGPT Work, and Codex. Your dot can use your existing connections within the permissions you’ve granted."

Dots privacy faqhelp.openai.comcaptured 2026-11-08

"This stops new access through that connection. It does not delete information your dot has already built into its context."

Dots privacy faqhelp.openai.comcaptured 2026-11-08

"It can read information from permitted connected sources and save private notes, but its research tools cannot directly:"

Dots privacy faqhelp.openai.comcaptured 2026-11-08

"You can also set up a separate Slack account for your dot, giving it its own identity and access in those services."

Dots privacy faqhelp.openai.comcaptured 2026-11-08
Agent actions Actions taken, browsing, credentials

Stated Activity View lists tasks and steps. Password changes and money transfers require takeover; purchases need approval. Secure-form passwords aren't shown to the model; signed-in sessions persist. Log retention unstated.

What the policies say (9 quotes)

"Activity View in the desktop app shows your dot’s ongoing and delegated tasks. You can see task descriptions and their status to follow its progress. You can also review steps your dot has taken."

Dots privacy faqhelp.openai.comcaptured 2026-11-08

"The most sensitive actions like changing a password or transferring money require you to take over so you can complete them yourself."

Dots privacy faqhelp.openai.comcaptured 2026-11-08

"Other actions like permanently deleting data or installing software may require approval each time you ask your dot to perform them."

Dots privacy faqhelp.openai.comcaptured 2026-11-08

"The form sends your credentials directly to the browser environment without exposing them to the model. Your dot can then continue using the signed-in session."

Dots privacy faqhelp.openai.comcaptured 2026-11-08

"They don’t cover passwords you share separately in a chat or document, or through a plugin."

Dots privacy faqhelp.openai.comcaptured 2026-11-08

"These purchases require your approval, which may be given in advance when it specifically covers the purchase."

Dots privacy faqhelp.openai.comcaptured 2026-11-08

"**Auto-review** checks certain planned actions against your instructions, Custom Rules, and safety requirements before they run."

Dots privacy faqhelp.openai.comcaptured 2026-11-08

"Whether a completed action can be reversed depends on the action and the app involved."

Dots privacy faqhelp.openai.comcaptured 2026-11-08

"Before your dot can access your computer’s camera, microphone, or screen, you must connect your computer to your dot."

Dots privacy faqhelp.openai.comcaptured 2026-11-08
Your inputs Who owns them

Inferred Inferred: the dots FAQ is silent. Dots run inside ChatGPT, whose consumer Terms keep your Input rights; business workspaces fall under the customer agreement, which does the same.

What the policies say (4 quotes)

"These Terms of Use apply to your use of ChatGPT, DALL·E, and OpenAI’s other services for individuals"

Terms of useopenai.comcaptured 2026-11-08

"As between you and OpenAI, and to the extent permitted by applicable law, you (a) retain your ownership rights in Input and (b) own the Output."

Terms of useopenai.comcaptured 2026-11-08

"For information processed on behalf of business customers, the applicable customer agreement governs how it is handled."

Dots privacy faqhelp.openai.comcaptured 2026-11-08

"As between Customer and OpenAI, to the extent permitted by applicable law, Customer: (a) retains all ownership rights in Input; and (b) owns all Output."

Services agreementopenai.comcaptured 2026-11-08
Outputs Who owns them

Inferred Inferred: the dots FAQ is silent. Under the ChatGPT Terms and the Services Agreement, the user or customer owns Output and OpenAI assigns its rights.

What the policies say (3 quotes)

"We hereby assign to you all our right, title, and interest, if any, in and to Output."

Terms of useopenai.comcaptured 2026-11-08

"OpenAI hereby assigns to Customer all OpenAI’s right, title, and interest, if any, in and to Output."

Services agreementopenai.comcaptured 2026-11-08

"For information processed on behalf of business customers, the applicable customer agreement governs how it is handled."

Dots privacy faqhelp.openai.comcaptured 2026-11-08
License you grant Scope, and whether it is perpetual

Inferred Inferred: the dots FAQ is silent. Personal use falls under the Terms (use to run and improve services); business use under the Services Agreement (limited rights to deliver the Services).

What the policies say (3 quotes)

"We may use Content to provide, maintain, develop, and improve our Services, comply with applicable law, enforce our terms and policies, and keep our Services safe."

Terms of useopenai.comcaptured 2026-11-08

"Customer grants OpenAI only the limited rights that are reasonably necessary for OpenAI to deliver the Services."

Services agreementopenai.comcaptured 2026-11-08

"For information processed on behalf of business customers, the applicable customer agreement governs how it is handled."

Dots privacy faqhelp.openai.comcaptured 2026-11-08
Sharing Model providers, subprocessors, ads

Stated OpenAI's service providers (hosting, cloud, support, safety, email) may access or store dot data under its instructions. Third-party services a dot uses keep their own coverage and restrictions.

What the policies say (2 quotes)

"OpenAI uses service providers to help operate its services, including hosting, cloud infrastructure, support, safety, and email delivery. These providers may access, process, or store personal information under OpenAI’s instructions to carry out those services."

Dots privacy faqhelp.openai.comcaptured 2026-11-08

"Other features and third-party services your dot uses retain their own coverage and restrictions."

Dots privacy faqhelp.openai.comcaptured 2026-11-08
Where data lives Regions and residency

Inferred Inferred: the FAQ points to a ChatGPT residency article for supported storage and inference regions, suggesting regional options exist for dots; no regions are listed.

What the policy says

"For supported storage and inference regions, see"

Dots privacy faqhelp.openai.comcaptured 2026-11-08
Enterprise controls Retention settings, DPA, SSO

Stated Enterprise access and pause controls; customer-managed keys (EKM) for new dots in eligible workspaces; HIPAA-eligible under a BAA; Custom Rules, which can't override core safety requirements.

What the policies say (5 quotes)

"In an eligible Enterprise workspace configured with Enterprise Key Management (EKM), long-term data in new dots supports customer-managed encryption keys."

Dots privacy faqhelp.openai.comcaptured 2026-11-08

"Dots are HIPAA-eligible when used from an eligible ChatGPT workspace under a BAA and enabled for your role."

Dots privacy faqhelp.openai.comcaptured 2026-11-08

"For Enterprise access and pause controls, see"

Dots privacy faqhelp.openai.comcaptured 2026-11-08

"Custom Rules let you customize these and tell your dot which supported actions it can take independently, which require your approval, and which it should not take."

Dots privacy faqhelp.openai.comcaptured 2026-11-08

"Custom Rules cannot turn off core safety requirements, such as when your dot asks you to take back over to change a password."

Dots privacy faqhelp.openai.comcaptured 2026-11-08

Notes

Open questions

Questions the captured policies leave unanswered, and where the answer probably lives.

Documents read