gjalla logogjalla
Talk to us

AI data policies

xAI (Grok, Grok Bot)

What xAI (Grok, Grok Bot) keeps, for how long, whether it trains on it, and what rights you grant, for Grok (grok.com and Grok iOS/Android apps), Grok on X (governed by X Corp. terms and privacy policy), xAI API (Enterprise Terms, DPA), Grok Business / Grok Enterprise, Grok Bot (AI teammate in X Chat). Each answer quotes xAI (Grok, Grok Bot)'s own policy.

Type Model maker Policies captured 2026-11-08 10 documents read How this is made

Grok (grok.com and Grok iOS/Android apps) Consumer app

Default retention How long prompts and chats are kept

Stated Conversations stay in your account until you delete them. The policy says data is kept while there is a 'legitimate business need' and gives no fixed period.

What the policies say (2 quotes)

"You are in control of how long your data is on SpaceXSI’s systems. You can keep your data on your SpaceXSI account for as long as you wish."

Consumer FAQsx.aicaptured 2026-11-08

"We retain your personal information where we have an ongoing legitimate business need to do so."

Privacy Policyx.aicaptured 2026-11-08
After you delete How long until it is gone

Stated Deleted chats, deleted accounts and Private Chat conversations are removed within 30 days, apart from the exceptions listed under retention_exceptions.

What the policies say (2 quotes)

"Further, if you choose to delete any or all of your conversations or if you choose to delete your account, we will delete the data within 30 days unless it is necessary to retain the data for legal, compliance, or safety purposes."

Privacy Policyx.aicaptured 2026-11-08

"After you indicate that you want your data deleted, it will take up to 30 days to delete from SpaceXSI systems."

Consumer FAQsx.aicaptured 2026-11-08
Kept longer when Safety flags, legal holds, backups

Stated Kept past 30 days for legal, compliance, safety or security reasons (court orders, complaints, misuse, litigation). De-identified copies cut off from your account are exempt. No durations given.

What the policies say (3 quotes)

"When we have a legal obligation to do so (e.g., if we receive a court order, we would retain your information for longer than our usual retention periods);"

Privacy Policyx.aicaptured 2026-11-08

"To protect the safety, security, and integrity of our business and the Service, as well as to protect our rights and property and those of others (e.g., if we detect misuse of our Service or otherwise detect unusual activity on your account or in your interactions with us); and"

Privacy Policyx.aicaptured 2026-11-08

"If you delete conversations from your account or if you use Private Chat, conversations will be removed from our systems within 30 days, unless they have been de-identified or pseudoanonymized and disassociated from your account or we have to retain them for safety, security, or legal reasons."

Consumer FAQsx.aicaptured 2026-11-08
Zero data retention Whether it exists and who can get it

Inferred Inferred: zero data retention appears only for the business API. The closest consumer option, Private Chat, still keeps conversations up to 30 days.

What the policies say (2 quotes)

"when Private Chat is turned on, conversations will not appear in your conversation history and your conversations will be deleted from SpaceXSI systems within 30 days unless it is necessary that they be kept longer for legal, compliance, or safety purposes."

Privacy Policyx.aicaptured 2026-11-08

"Except when Customer elects to use SpaceXSI’s Zero Data Retention-enabled APIs (“**ZDR-Enabled API**” or “**ZDR**”)"

Terms of Service - Enterprisex.aicaptured 2026-11-08
Trains on your data By default

Inferred Inferred: yes. xAI may train on prompts and responses, and the control is an opt-out toggle. Logged-out users in some non-EU/UK regions can't opt out.

What the policies say (3 quotes)

"We may use your content and interactions with Grok (e.g., prompts, searches, and other materials you submit) along with Grok's responses to train our models."

Consumer FAQsx.aicaptured 2026-11-08

"As a result, in some regions (excluding the EU/UK), when you use Grok without logging in, you won’t have the option to opt out of model training."

Consumer FAQsx.aicaptured 2026-11-08

"Where available, you may access our Service without logging in; when doing so, where permitted, you grant us full rights to use any data you provide to or obtain from our Service for product development and model training purposes."

Terms of Service - Consumerx.aicaptured 2026-11-08
Opting out How, and what it doesn't cover

Stated Turn off 'Improve the model' in Settings, or use Private Chat. This covers new conversations only. Feedback you give (thumbs up/down) can still be used for training.

What the policies say (3 quotes)

"On the mobile app, to select or deselect using your content for model training, go to Settings, Data Controls, and select or deselect “Improve the model.”"

Consumer FAQsx.aicaptured 2026-11-08

"Once you select that your data should not be used for training, your new conversations will not be used to train our models."

Consumer FAQsx.aicaptured 2026-11-08

"Please note that, even if you opt out of model training, when you subsequently decide to voluntarily provide feedback, that feedback may be used for training purposes."

Consumer FAQsx.aicaptured 2026-11-08
Human review Whether people read conversations

Stated Yes. Automated classifiers scan usage, and a limited number of authorized staff may read your conversations to improve the model, investigate security incidents or misuse, and meet legal obligations.

What the policies say (2 quotes)

"A limited number of our authorized personnel may review your conversations with Grok for specific business purposes, including improving model performance, investigating security incidents and potential misuse of our services, and complying with our legal obligations."

Consumer FAQsx.aicaptured 2026-11-08

"Automated systems that analyze your use of the Service and User Content may be used for business, safety, and compliance purposes."

Terms of Service - Consumerx.aicaptured 2026-11-08
Memory Remembered facts and profiles

Stated No memory feature is described. A 'Personalize Grok using X' toggle uses your X data. How that profile is stored, viewed or deleted is not stated.

What the policies say (2 quotes)

"Yes, your Grok experience can be personalized if you allow your X data and interactions to be used for personalization."

Consumer FAQsx.aicaptured 2026-11-08

"You can elect to allow your X data to be used for personalization on the Grok mobile app by going to Settings, Data Controls, and then toggle on or off “Personalize Grok using X”."

Consumer FAQsx.aicaptured 2026-11-08
Connected apps Email, calendar, drive

Stated OAuth connectors (Gmail, Drive, Outlook, Teams, Salesforce, custom MCP and others) let Grok fetch data on demand. Google content isn't used for training. Storage and disconnect handling: not stated.

What the policies say (3 quotes)

"Each one authenticates via OAuth, so you connect once and Grok can access your data on demand."

Connectorsdocs.x.aicaptured 2026-11-08

"For users who opt to connect to Google Apps via Google OAuth, SpaceXSI shall not use any Google Apps content for any of its internal AI or other training purposes (such as training its machine learning models), including developing new products or services based on such content."

Privacy Policyx.aicaptured 2026-11-08

"If you select a feature that involves sending your User Content to, or accessing your User Content hosted on, such a third-party service, you are instructing and authorizing SpaceXSI to send your User Content out of the Service."

Terms of Service - Consumerx.aicaptured 2026-11-08
Agent actions Actions taken, browsing, credentials

Stated Grok can take 'Agentic Actions' (browsing, code, sending messages, banking), and you're responsible for them. Third-party login may store your credentials or tokens. Action-log retention: not stated.

What the policies say (3 quotes)

"Certain features of the Service may enable Grok to take autonomous actions on your behalf (“**Agentic Actions**”), including but not limited to web browsing, code execution, sending communications, modifying files, tool invocation, data processing, or interactions with third-party services, including financial institutions."

Terms of Service - Consumerx.aicaptured 2026-11-08

"You are responsible for User Content and Agentic Actions, including ensuring that it does not violate any applicable law or these Terms and any consequences, costs, or liabilities arising therefrom."

Terms of Service - Consumerx.aicaptured 2026-11-08

"you give us permission to access, use, and store your information from that service, as permitted by that service, which may include log-in credentials and/or access tokens for that service."

Terms of Service - Consumerx.aicaptured 2026-11-08
Your inputs Who owns them

Stated You keep ownership of your inputs 'as between you and SpaceXSI', to the extent the law allows.

What the policies say (2 quotes)

"To the extent permitted by applicable law, and as between you and SpaceXSI, you retain your ownership rights to the User Content."

Terms of Service - Consumerx.aicaptured 2026-11-08

"You own the Inputs and Outputs."

Consumer FAQsx.aicaptured 2026-11-08
Outputs Who owns them

Stated You own outputs and may use them commercially, but xAI asks you to credit Grok. Grokipedia output and system metadata/logs are excluded, and outputs may not be unique to you.

What the policies say (3 quotes)

"You are free to use Grok’s Outputs (including generated images) from your conversations as you wish, including for commercial use."

Consumer FAQsx.aicaptured 2026-11-08

"receive output from the Service (excluding output from Grokipedia and excluding system metadata and logs) based on the Input (“**Output**”)."

Terms of Service - Consumerx.aicaptured 2026-11-08

"When using Output or SpaceXSI’s name, logos, trademarks, or other brand elements, you are required to obtain our permission and attribute your generation of the Output to the Service, as detailed in our [Brand Guidelines](/legal/brand-guidelines)."

Terms of Service - Consumerx.aicaptured 2026-11-08
License you grant Scope, and whether it is perpetual

Stated Very broad: an irrevocable, perpetual, transferable, sublicensable worldwide license over your inputs for any purpose, including likeness and voice. Usage Data and Feedback are assigned to xAI.

What the policies say (3 quotes)

"you grant an irrevocable, perpetual, transferable, sublicensable, royalty-free, and worldwide right to SpaceXSI to use, copy, store, modify, process, adapt, transmit, distribute, reproduce, publish, upload, download, display in public forums, list information regarding, make derivative works of, and distribute such Content"

Terms of Service - Consumerx.aicaptured 2026-11-08

"To the extent the User Content includes a person’s image, likeness, voice, or other similar attributes, you grant SpaceXSI the same rights to use those attributes as part of the User Content as described above."

Terms of Service - Consumerx.aicaptured 2026-11-08

"All Usage Data is and will be owned solely and exclusively by us"

Terms of Service - Consumerx.aicaptured 2026-11-08
Sharing Model providers, subprocessors, ads

Stated Shared with service providers, related companies, buyers in business transfers, and for legal reasons. Cookies serve targeted advertising. xAI says it doesn't sell your data.

What the policies say (4 quotes)

"we provide your personal information to service providers including providers of hosting, cloud, analytics, content delivery, support and safety monitoring, payment and transaction, and other technology services, for the purposes described above."

Privacy Policyx.aicaptured 2026-11-08

"Deliver relevant content and targeted advertising;"

Privacy Policyx.aicaptured 2026-11-08

"No. We do not sell your data to third parties as defined by applicable laws."

Consumer FAQsx.aicaptured 2026-11-08

"(e) to share analytics and other derived Usage Data with third-parties"

Terms of Service - Consumerx.aicaptured 2026-11-08
Where data lives Regions and residency

Stated Personal information is transferred to and processed in the United States. No residency options are described. A separate Europe addendum is referenced but wasn't captured.

What the policies say (2 quotes)

"your personal information will be transferred to, and/or processed in, the United States."

Terms of Service - Consumerx.aicaptured 2026-11-08

"SpaceXSI is a US-based company"

Privacy Policyx.aicaptured 2026-11-08
Enterprise controls Retention settings, DPA, SSO

Stated Not an enterprise product. Signing up with a work email may link your account to your employer's Grok Enterprise subscription, whose admin can access and monitor it.

What the policy says

"If you use an email address associated with your employer or other organization, your account may be linked to that organization’s Grok Enterprise subscription. In such cases, the organization’s administrator may access, monitor and control your account"

Terms of Service - Consumerx.aicaptured 2026-11-08

Grok on X (governed by X Corp. terms and privacy policy) Consumer app

Default retention How long prompts and chats are kept

Inferred Inferred: X keeps 'usage information' for the life of your account or until removed. It doesn't say this covers Grok chats. xAI's retention of shared data: not stated.

What the policy says

"We keep your usage information, such as the content you post, your interactions with other users’ content and how you interact with others on the platform for the duration of your account or until such content is removed."

X Privacy Policyx.comcaptured 2026-11-08
After you delete How long until it is gone

Stated You can delete all Grok conversation history at once in X settings. Deleted conversations are removed within 30 days, unless kept for security or legal reasons.

What the policy says

"Deleted conversations are removed from our systems within 30 days, unless we have to keep them for security or legal reasons."

X help about grokhelp.x.comcaptured 2026-11-08
Kept longer when Safety flags, legal holds, backups

Stated X may keep data longer for legal process, litigation and safety or abuse work. Suspended accounts' identifiers may be kept indefinitely. No Grok-specific durations given.

What the policies say (2 quotes)

"We may need to keep certain information longer than our policies specify in order to comply with legal requirements and for safety and security reasons."

X Privacy Policyx.comcaptured 2026-11-08

"Where you violate our Rules and your account is suspended, we may keep the identifiers you used to create the account (such as your email address or phone number) indefinitely to prevent repeat policy offenders from creating new accounts."

X Privacy Policyx.comcaptured 2026-11-08
Zero data retention Whether it exists and who can get it

Not stated Not stated. The X captured policies describe no zero-retention option for Grok on X.

Trains on your data By default

Inferred Inferred: yes. X may share your public data and Grok inputs and results with xAI for training, and the control is an opt-out setting.

What the policies say (2 quotes)

"may share with [xAI](https://x.ai/) your public \>x\< data as well as your user interactions, inputs and results with Grok on \>x\< to train and fine-tune Grok and other generative AI models."

X help about grokhelp.x.comcaptured 2026-11-08

"You agree that this license includes the right for us to (i) analyze text and other information you provide and to otherwise provide, promote, and improve the Services, including, for example, for use with and training of our machine learning and artificial intelligence models, whether generative or another type"

X Terms of Servicex.comcaptured 2026-11-08
Opting out How, and what it doesn't cover

Stated Untick data sharing under X Privacy & Safety > Grok & Third-party Collaborators. Deployed models still learn from Grok-powered X features, and feedback can still be used.

What the policies say (3 quotes)

"However, please note that when you use an \>x\< feature that is powered by Grok (e.g. \>x\< recommendations), Grok will learn from your interactions and the opt-out does not prevent a deployed model from learning as a result of its normal use."

X help about grokhelp.x.comcaptured 2026-11-08

"If you provide such feedback, \>x\< and xAI may use that conversation and any such conversation related data to train and fine-tune Grok and improve your experience."

X help about grokhelp.x.comcaptured 2026-11-08

"Please note that you additionally may also prevent your posts from being used for such fine-tuning and training by making your account private."

X help about grokhelp.x.comcaptured 2026-11-08
Human review Whether people read conversations

Inferred Inferred: X reserves the right to access and read any information for legal, enforcement and security reasons. Nothing says people read Grok chats specifically.

What the policies say (2 quotes)

"We also reserve the right to access, read, preserve, and disclose any information as we reasonably believe is necessary to (i) satisfy any applicable law, regulation, legal process or governmental request; (ii) enforce the Terms, including investigation of potential violations hereof;"

X Terms of Servicex.comcaptured 2026-11-08

"data sets reviewed and curated by AI Tutors who are human reviewers"

X help about grokhelp.x.comcaptured 2026-11-08
Memory Remembered facts and profiles

Stated Grok Personalization shares your X profile, posts, interests and Grok inputs (including voice transcripts) with xAI. You can turn it off in X settings. Retention: not stated.

What the policies say (2 quotes)

"may share your \>x\< data, for example, public profile, public posts, top posts, engagement, and your interests, including how you interact with Grok, what you input, and the results you receive, with xAI."

X help about grokhelp.x.comcaptured 2026-11-08

"If you opt-out, you can still use Grok on the \>x\< platform, but your personal data will not be used to personalize your Grok experience."

X help about grokhelp.x.comcaptured 2026-11-08
Connected apps Email, calendar, drive

Not stated Not stated. The X captured policies don't describe Grok on X connecting to email, calendar or drive accounts.

Agent actions Actions taken, browsing, credentials

Stated X Terms make you responsible for 'features that perform autonomous actions'. Logs, browsing records and stored credentials for Grok on X are not described.

What the policy says

"You are responsible for your use of the Services, including any features that perform autonomous actions"

X Terms of Servicex.comcaptured 2026-11-08
Your inputs Who owns them

Stated You keep your rights in Content you submit or input, including prompts.

What the policy says

"You retain your rights to any Content, including anything referenced therein, you submit, input, create, generate, post, or display on or through the Services."

X Terms of Servicex.comcaptured 2026-11-08
Outputs Who owns them

Stated X Terms say you keep rights to Content you 'create' or 'generate', which covers Grok outputs. You are also responsible for outputs.

What the policies say (2 quotes)

"You retain your rights to any Content, including anything referenced therein, you submit, input, create, generate, post, or display on or through the Services."

X Terms of Servicex.comcaptured 2026-11-08

"including any inputs, prompts, outputs, and/or information obtained or created through the Services"

X Terms of Servicex.comcaptured 2026-11-08
License you grant Scope, and whether it is perpetual

Stated A worldwide, royalty-free, sublicensable license to use your Content for any purpose, including AI training. It survives termination but isn't called perpetual or irrevocable.

What the policies say (2 quotes)

"you grant us a worldwide, non-exclusive, royalty-free license (with the right to sublicense) to use, copy, reproduce, process, adapt, modify, publish, transmit, display, upload, download, and distribute such Content, including anything referenced therein, in any and all media or distribution methods now known or later developed, for any purpose."

X Terms of Servicex.comcaptured 2026-11-08

"except that the following sections shall continue to apply: 2, 3, 5, 6, and the misuse provisions of Section 4 (“Misuse of the Services”)."

X Terms of Servicex.comcaptured 2026-11-08
Sharing Model providers, subprocessors, ads

Stated X shares Grok data with xAI. Unless you opt out, 'third-party collaborators' may train their own AI on it. Also shared with service providers, advertisers and affiliates. No sale.

What the policies say (3 quotes)

"If you do not opt out, in some instances the recipients of the information may use it for their own independent purposes in addition to those stated in X’s Privacy Policy, including, for example, to train their artificial intelligence models, whether generative or otherwise."

X Privacy Policyx.comcaptured 2026-11-08

"We may share information amongst our [*affiliates*](https://help.x.com/rules-and-policies/x-services-and-corporate-affiliates) to provide our products and services."

X Privacy Policyx.comcaptured 2026-11-08

"No. We do not sell your data."

X help about grokhelp.x.comcaptured 2026-11-08
Where data lives Regions and residency

Stated Data may go to the US, Ireland and other countries under SCCs and the Data Privacy Framework. The EU/UK controller is X Internet Unlimited Company. No residency choice.

What the policies say (2 quotes)

"including the transfer of this information to the United States, Ireland, and/or other countries for storage, processing and use by us and our affiliates."

X Terms of Servicex.comcaptured 2026-11-08

"If you live in the European Union, EFTA States, or the United Kingdom, the data controller responsible for your personal data is X Internet Unlimited Company"

X Privacy Policyx.comcaptured 2026-11-08
Enterprise controls Retention settings, DPA, SSO

Not stated Not stated. Grok on X is described only as a consumer feature of X accounts.

xAI API (Enterprise Terms, DPA) API

Default retention How long prompts and chats are kept

Stated Inputs and outputs are deleted automatically no later than 30 days after the session ends, unless a different period is agreed or set in self-service tools.

What the policies say (3 quotes)

"All User Content will be automatically and permanently deleted no later than 30 days after the end of the interaction or session in which it was submitted unless a different retention period is:"

Terms of Service - Enterprisex.aicaptured 2026-11-08

"Inputs and outputs are automatically deleted within 30 days, unless (a) otherwise agreed in writing, (b) SpaceXSI is legally required to retain them because, for example, they are flagged as potentially violating our Terms of Service or AUP."

Enterprise FAQsx.aicaptured 2026-11-08

"Our data retention period is at our customer's discretion as it regards their user data, subject to legal requirements."

Data processing addendumx.aicaptured 2026-11-08
After you delete How long until it is gone

Stated Customers can delete data at will; after a deletion request, login data, prompt/response pairs and billing info are deleted 'typically within 30 days'. On termination, deletion follows the Agreement.

What the policies say (3 quotes)

"Upon termination of the Agreement, we shall delete any Personal Data in our possession in accordance with the Agreement, except to the extent that we are required to retain copies under applicable laws"

Data processing addendumx.aicaptured 2026-11-08

"SpaceXSI shall have no obligation to retain, maintain, or provide access to Customer data beyond what is required by applicable law or this Agreement."

Terms of Service - Enterprisex.aicaptured 2026-11-08

"Customers are able to delete their data at will. Following a data deletion request, our systems automatically delete all login data, prompt/response pairs, and billing information stored within our systems typically within 30 days."

Data processing addendumx.aicaptured 2026-11-08
Kept longer when Safety flags, legal holds, backups

Stated Kept longer if law requires or for safety, security, moderation or abuse investigations (minimum, until the reason ends). User Content is continuously backed up and versioned; backup retention isn't stated.

What the policies say (3 quotes)

"(b) required by applicable law; or (c) reasonably necessary for safety, security, compliance, moderation, abuse prevention, or investigation of suspected violations of this Agreement, in each of which cases SpaceXSI will retain only the minimum data necessary and will permanently delete it promptly when the justification no longer applies."

Terms of Service - Enterprisex.aicaptured 2026-11-08

"User Content is continuously backed up, and access controls are implemented to prevent unauthorized modification or access."

Data processing addendumx.aicaptured 2026-11-08

"User Content is versioned and encrypted such that it is possible to revert to a previous state, while verifying integrity."

Data processing addendumx.aicaptured 2026-11-08
Zero data retention Whether it exists and who can get it

Stated Opt-in ZDR-Enabled APIs delete content on delivery or within an hour, with no logs or backups, even for legal needs. Personal data and PHI (plus a BAA) must use ZDR.

What the policies say (3 quotes)

"SpaceXSI will delete all such User Content, including any transient storage or processing artifacts, upon the earlier of (a) one hour after completion of the applicable inference request; or (b) delivery of the response; and no logs, backups, persistent copies, or other durable storage containing User Content will thereafter be retained for any purpose, including safety, debugging, or legal compliance."

Terms of Service - Enterprisex.aicaptured 2026-11-08

"SpaceXSI requires that Customer does not submit Personal Data to SpaceXSI’s non-ZDR Services."

Data processing addendumx.aicaptured 2026-11-08

"unless Customer has first entered into a Business Associate Agreement or Amendment (“**BAA**”) with SpaceXSI that amends this Agreement and also uses SpaceXSI’s ZDR-Enabled API to submit that data."

Terms of Service - Enterprisex.aicaptured 2026-11-08
Trains on your data By default

Stated No. Business inputs and outputs aren't used for training, 'subject to disclosures to Customer and Customer-controlled user settings'. Some customers trade training rights for free credits.

What the policies say (2 quotes)

"SpaceXSI will not use any User Content to train any foundation models, large language models, or other artificial intelligence systems or to develop any new products, services, or features, subject to disclosures to Customer and Customer-controlled user settings."

Terms of Service - Enterprisex.aicaptured 2026-11-08

"In some instances we may offer free credits in exchange for you agreeing to permit us to train on your business data."

Enterprise FAQsx.aicaptured 2026-11-08
Opting out How, and what it doesn't cover

Stated No opt-out needed because training is off by default. Outside ZDR, xAI may still create and own de-identified, aggregated usage data for any lawful purpose.

What the policy says

"Except when Customer elects to use SpaceXSI’s Zero Data Retention-enabled APIs (“**ZDR-Enabled API**” or “**ZDR**”), SpaceXSI may create and use, for any lawful purpose, de-identified and/or aggregated data derived from Customer’s use of the Services"

Terms of Service - Enterprisex.aicaptured 2026-11-08
Human review Whether people read conversations

Stated Automated classifiers scan usage. Authorized staff may review data when legally required (e.g. incidents, misuse), under confidentiality agreements; the DPA says User Content is accessed de-identified.

What the policies say (4 quotes)

"A limited number of authorized SpaceXSI personnel may review your data when legally required, such as investigating security incidents and potential misuse of our services."

Enterprise FAQsx.aicaptured 2026-11-08

"SpaceXSI may monitor usage of the Services for compliance with this Agreement."

Terms of Service - Enterprisex.aicaptured 2026-11-08

"Access to User Content is restricted to authorized personnel only, and all personnel with access are subject to confidentiality agreements."

Data processing addendumx.aicaptured 2026-11-08

"Only the information necessary to provide services is collected during your use of SpaceXSI systems, and all User Content is accessed in a de-identified manner."

Data processing addendumx.aicaptured 2026-11-08
Memory Remembered facts and profiles

Not stated Not stated. The enterprise terms, DPA and enterprise FAQ describe no persistent memory for the API.

Connected apps Email, calendar, drive

Inferred Inferred: data sent 'via any third-party integration' counts as Input and is treated like other content. Third-party services follow their own terms. Disconnect handling: not stated.

What the policies say (2 quotes)

"that Customer, its Permitted Users, or End Users submit to or process through the Services (directly or via any third-party integration)."

Terms of Service - Enterprisex.aicaptured 2026-11-08

"Third-Party Services are governed by the terms between Customer and the applicable third-party provider (“**Third-Party Terms**”)."

Terms of Service - Enterprisex.aicaptured 2026-11-08
Agent actions Actions taken, browsing, credentials

Not stated Not stated. The API terms don't address logs of agent or tool actions, browsing, or stored credentials.

Your inputs Who owns them

Stated The customer keeps all rights in its inputs.

What the policy says

"Customer (a) retains all right, title, and interest (including all intellectual-property rights) in and to the Input"

Terms of Service - Enterprisex.aicaptured 2026-11-08
Outputs Who owns them

Stated The customer owns outputs permanently, and xAI assigns its rights in them, excluding xAI technology. You may not use outputs to train AI models unless an Order Form allows it.

What the policies say (2 quotes)

"(b) owns all right, title, and interest in the Output in perpetuity and, to the fullest extent possible under applicable law, SpaceXSI hereby assigns to Customer all of its right, title, and interest in such Output"

Terms of Service - Enterprisex.aicaptured 2026-11-08

"use any Output to train any foundation models, large language models, or other artificial intelligence systems except as may be expressly permitted in an Order Form"

Terms of Service - Enterprisex.aicaptured 2026-11-08
License you grant Scope, and whether it is perpetual

Stated An irrevocable, worldwide, transferable license limited to running the service, fighting fraud and abuse, and safety and compliance work. Feedback gets a separate perpetual license.

What the policy says

"Customer hereby grants to SpaceXSI a non-exclusive, worldwide, irrevocable, transferable, fully paid-up, royalty-free right and license to, store, use, transmit, modify, and otherwise process User Content as reasonably necessary to: (i) provide the Services to Customer; (ii) detect, prevent, or address fraud, security risks, abuse, non-compliance with this Agreement, and (iii) conduct safety or compliance operations."

Terms of Service - Enterprisex.aicaptured 2026-11-08
Sharing Model providers, subprocessors, ads

Stated Subprocessors are listed publicly, with 15 days' notice and a right to object. Personal data is not sold or shared under US privacy laws. xAI is liable for subcontractors.

What the policies say (3 quotes)

"SpaceXSI will notify you if we add or replace Subprocessors at least fifteen (15) days before such changes take effect."

Data processing addendumx.aicaptured 2026-11-08

"not (i) "sell" or "share" Customer Personal Data (as defined by the CCPA or equivalent concepts under U.S. Privacy Laws)"

Data processing addendumx.aicaptured 2026-11-08

"No. We do not sell your data to third parties as defined by applicable laws."

Enterprise FAQsx.aicaptured 2026-11-08
Where data lives Regions and residency

Stated Data may be processed worldwide, including the US and wherever subprocessors operate. SCCs and the UK Addendum cover transfers out of Europe. No data-residency option is described.

What the policy says

"You acknowledge and agree that SpaceXSI may transfer and process Personal Data on a global basis outside Europe as necessary to provide the Services, including in the United States and other countries where SpaceXSI and its Subprocessors maintain data processing operations."

Data processing addendumx.aicaptured 2026-11-08
Enterprise controls Retention settings, DPA, SSO

Stated DPA included automatically, BAA by questionnaire, custom retention via Order Form or self-service, audit documents on request, breach notice within 48h where feasible. SSO and audit logs: not stated.

What the policies say (5 quotes)

"Yes, if you submit personal data to our Services, our Data Processing Addendum (DPA) applies and is automatically incorporated into our Enterprise Terms of Service."

Enterprise FAQsx.aicaptured 2026-11-08

"To inquire about a Business Associate Agreement (BAA), please complete our BAA Questionnaire."

Enterprise FAQsx.aicaptured 2026-11-08

"explicitly agreed in an Order Form, Documentation, or conspicuous notices within the Services or otherwise selected by Customer via self-service tools made available by SpaceXSI"

Terms of Service - Enterprisex.aicaptured 2026-11-08

"We will notify you without undue delay, and where feasible, no later than 48 hours, after we become aware of any Security Incident."

Data processing addendumx.aicaptured 2026-11-08

"Workspace administrators (customers) are able to authorize additional parties as they see fit."

Data processing addendumx.aicaptured 2026-11-08

Grok Business / Grok Enterprise Enterprise

Default retention How long prompts and chats are kept

Inferred Inferred: the Enterprise Terms cover 'related SpaceXSI Services (including Grok)' for businesses, so the 30-day auto-deletion likely applies. No Grok Business-specific retention page was captured.

What the policies say (2 quotes)

"These terms are for enterprise (business) users of the SpaceXSI API and related SpaceXSI Services (including Grok) who are at least 18 years old."

Terms of Service - Enterprisex.aicaptured 2026-11-08

"All User Content will be automatically and permanently deleted no later than 30 days after the end of the interaction or session in which it was submitted unless a different retention period is:"

Terms of Service - Enterprisex.aicaptured 2026-11-08
After you delete How long until it is gone

Inferred Inferred from the DPA, which covers business services: deletion requests are processed 'typically within 30 days', and data is deleted on termination per the Agreement. Workspace-chat timing isn't stated.

What the policies say (2 quotes)

"Upon termination of the Agreement, we shall delete any Personal Data in our possession in accordance with the Agreement, except to the extent that we are required to retain copies under applicable laws"

Data processing addendumx.aicaptured 2026-11-08

"Customers are able to delete their data at will. Following a data deletion request, our systems automatically delete all login data, prompt/response pairs, and billing information stored within our systems typically within 30 days."

Data processing addendumx.aicaptured 2026-11-08
Kept longer when Safety flags, legal holds, backups

Inferred Inferred from the Enterprise Terms: data may be kept when the law requires or for safety, security, moderation or abuse investigations. Only the minimum, until the reason ends.

What the policy says

"reasonably necessary for safety, security, compliance, moderation, abuse prevention, or investigation of suspected violations of this Agreement, in each of which cases SpaceXSI will retain only the minimum data necessary and will permanently delete it promptly when the justification no longer applies."

Terms of Service - Enterprisex.aicaptured 2026-11-08
Zero data retention Whether it exists and who can get it

Inferred Inferred: ZDR is defined only as 'ZDR-Enabled APIs'. The captured policies don't say whether Grok Business or Enterprise workspaces can use it.

What the policy says

"Except when Customer elects to use SpaceXSI’s Zero Data Retention-enabled APIs (“**ZDR-Enabled API**” or “**ZDR**”)"

Terms of Service - Enterprisex.aicaptured 2026-11-08
Trains on your data By default

Stated No. Business user content isn't used to train models, subject to disclosures and customer-controlled settings. The consumer FAQ also says business and enterprise content isn't used to improve models.

What the policies say (2 quotes)

"SpaceXSI will not use any User Content to train any foundation models, large language models, or other artificial intelligence systems or to develop any new products, services, or features, subject to disclosures to Customer and Customer-controlled user settings."

Terms of Service - Enterprisex.aicaptured 2026-11-08

"Similarly, we do not use content from our business and enterprise customers to improve our models."

Consumer FAQsx.aicaptured 2026-11-08
Opting out How, and what it doesn't cover

Stated Training is off by default. xAI can still create and own de-identified or aggregated usage data (outside ZDR), and some customers get free credits for opting in to training.

What the policies say (2 quotes)

"SpaceXSI may create and use, for any lawful purpose, de-identified and/or aggregated data derived from Customer’s use of the Services"

Terms of Service - Enterprisex.aicaptured 2026-11-08

"In some instances we may offer free credits in exchange for you agreeing to permit us to train on your business data."

Enterprise FAQsx.aicaptured 2026-11-08
Human review Whether people read conversations

Inferred Inferred from the enterprise FAQ: automated classifiers, plus review by authorized staff when legally required (incidents, misuse). Admins may also monitor linked accounts.

What the policies say (2 quotes)

"A limited number of authorized SpaceXSI personnel may review your data when legally required, such as investigating security incidents and potential misuse of our services."

Enterprise FAQsx.aicaptured 2026-11-08

"the organization’s administrator may access, monitor and control your account"

Terms of Service - Consumerx.aicaptured 2026-11-08
Memory Remembered facts and profiles

Not stated Not stated. No captured policy describes memory or profiles for Grok Business or Enterprise.

Connected apps Email, calendar, drive

Stated A team admin must first provision each connector in the cloud console before members can use it. What connector data is stored, and what happens on disconnect, is not stated.

What the policy says

"For Grok Business and Enterprise users, a team admin must first provision a connector in the [cloud console](/grok/connector-management) before it is available to members of the organization."

Connectorsdocs.x.aicaptured 2026-11-08
Agent actions Actions taken, browsing, credentials

Not stated Not stated for business workspaces. The Agentic Actions terms appear only in the consumer terms.

Your inputs Who owns them

Stated The customer keeps all rights in its inputs.

What the policies say (2 quotes)

"Customer (a) retains all right, title, and interest (including all intellectual-property rights) in and to the Input"

Terms of Service - Enterprisex.aicaptured 2026-11-08

"You own the Inputs and Outputs."

Enterprise FAQsx.aicaptured 2026-11-08
Outputs Who owns them

Stated The customer owns outputs permanently, and xAI assigns its rights in them. xAI asks you to credit Grok.

What the policies say (2 quotes)

"(b) owns all right, title, and interest in the Output in perpetuity and, to the fullest extent possible under applicable law, SpaceXSI hereby assigns to Customer all of its right, title, and interest in such Output"

Terms of Service - Enterprisex.aicaptured 2026-11-08

"We do ask that you attribute the generated work to Grok as provided in SpaceXSI's Brand Guidelines."

Enterprise FAQsx.aicaptured 2026-11-08
License you grant Scope, and whether it is perpetual

Stated Irrevocable, transferable, worldwide license limited to running the service, preventing fraud and abuse, and safety and compliance. Feedback is assigned to xAI with a perpetual license.

What the policies say (2 quotes)

"Customer hereby grants to SpaceXSI a non-exclusive, worldwide, irrevocable, transferable, fully paid-up, royalty-free right and license to, store, use, transmit, modify, and otherwise process User Content as reasonably necessary to"

Terms of Service - Enterprisex.aicaptured 2026-11-08

"grants (and will cause its Permitted Users to grant) to SpaceXSI a perpetual, irrevocable, worldwide, royalty-free, fully paid-up, sublicensable license to use, reproduce, modify, distribute, create derivative works of, and otherwise exploit the Feedback"

Terms of Service - Enterprisex.aicaptured 2026-11-08
Sharing Model providers, subprocessors, ads

Stated Same DPA terms: a public subprocessor list with 15 days' notice of changes, and no selling or sharing of personal data. Connected third-party services fall under their own terms.

What the policies say (2 quotes)

"SpaceXSI's list of general Subprocessors is available at <https://x.ai/legal/subprocessor-list> ("**Subprocessor List**")."

Data processing addendumx.aicaptured 2026-11-08

"To the extent of any conflict between this Agreement and applicable Third-Party Terms, the Third-Party Terms will govern with respect to the relevant Third-Party Services."

Terms of Service - Enterprisex.aicaptured 2026-11-08
Where data lives Regions and residency

Stated Data may be processed globally, including the US. SCCs cover transfers out of Europe. No residency option is described.

What the policy says

"SpaceXSI may transfer and process Personal Data on a global basis outside Europe as necessary to provide the Services, including in the United States"

Data processing addendumx.aicaptured 2026-11-08
Enterprise controls Retention settings, DPA, SSO

Stated Admins provision connectors and can monitor accounts linked by work email. Custom retention via Order Form, DPA, BAA and audit documents are available. SSO and audit logs: not stated.

What the policies say (3 quotes)

"If you use an email address associated with your employer or other organization, your account may be linked to that organization’s Grok Enterprise subscription."

Terms of Service - Consumerx.aicaptured 2026-11-08

"Upon written request, and subject to reasonable notice and confidentiality agreements, we will provide access to documentation that adequately demonstrates our compliance with this DPA, including copies of certifications, audit reports, and/or other relevant documentation."

Data processing addendumx.aicaptured 2026-11-08

"Workspace administrators (customers) are able to authorize additional parties as they see fit."

Data processing addendumx.aicaptured 2026-11-08

Grok Bot (AI teammate in X Chat) Agent

Default retention How long prompts and chats are kept

Stated Your data is kept for the life of your Grok Bot account unless you delete it.

What the policy says

"Unless otherwise deleted by you as set forth below your data will be retained for the life of your Grok Bot account."

X help about grokhelp.x.comcaptured 2026-11-08
After you delete How long until it is gone

Stated You can delete your Grok Bot account in Grok Bot settings. How long deletion takes is not stated.

What the policy says

"You can delete your Grok Bot account in your Grok Bot setting."

X help about grokhelp.x.comcaptured 2026-11-08
Kept longer when Safety flags, legal holds, backups

Not stated Not stated. The X help page gives no legal, safety or backup exceptions for Grok Bot, and the Cursor Privacy Policy that governs it wasn't captured.

Zero data retention Whether it exists and who can get it

Not stated Not stated.

Trains on your data By default

Inferred Inferred: Grok Bot chats in X Chat may be used for training. The control is an X opt-out setting, but the default is never stated.

What the policy says

"You can control whether your interactions with Grok Bot in \>x\< Chat are used to train and improve AI models."

X help about grokhelp.x.comcaptured 2026-11-08
Opting out How, and what it doesn't cover

Stated Untick the same X setting used for Grok on X (Grok & Third-party Collaborators). Opting out means your data isn't used for training.

What the policy says

"Opting out means your data will not be used for training. You can still use Grok Bot normally."

X help about grokhelp.x.comcaptured 2026-11-08
Human review Whether people read conversations

Not stated Not stated.

Memory Remembered facts and profiles

Not stated Not stated.

Connected apps Email, calendar, drive

Stated Grok Bot signs in to tools you choose, and you're responsible for its third-party access. The captured policies don't say what data it stores from those tools or how long.

What the policies say (2 quotes)

"Use \>x\< Chat to message your Grok Bot to sign in to the tools you select, work through tasks you direct, and to message back results."

X help about grokhelp.x.comcaptured 2026-11-08

"You remain responsible for the requests you make, any third party access by Grok Bot, and for reviewing what Grok Bot proposes as an action."

X help about grokhelp.x.comcaptured 2026-11-08
Agent actions Actions taken, browsing, credentials

Stated Grok Bot proposes actions, and you allow once, always allow similar actions, or deny. Action logs and credential storage are covered on an approvals/security docs page that wasn't captured.

What the policies say (2 quotes)

"You can allow an action once, set similar actions to always allow, or deny them."

X help about grokhelp.x.comcaptured 2026-11-08

"For more details, see Grok Bot [Approvals, Security and Privacy](https://docs.x.ai/grok-bot/approvals-security-and-privacy)."

X help about grokhelp.x.comcaptured 2026-11-08
Your inputs Who owns them

Not stated Not stated. No Grok Bot terms of service were captured.

Outputs Who owns them

Not stated Not stated. No Grok Bot terms of service were captured.

License you grant Scope, and whether it is perpetual

Not stated Not stated. No Grok Bot terms of service were captured.

Sharing Model providers, subprocessors, ads

Stated Grok Bot falls under the Cursor Privacy Policy, not xAI's, and X activity remains under X's policy. Cursor's terms weren't captured, so sharing details are unknown.

What the policy says

"Use of Grok Bot is governed by the [Cursor Privacy Policy](https://cursor.com/privacy). When you use Grok Bot in \>x\< Chat, your activity on \>x\< is also subject to the [\>x\< Privacy Policy](https://x.com/privacy)."

X help about grokhelp.x.comcaptured 2026-11-08
Where data lives Regions and residency

Not stated Not stated.

Enterprise controls Retention settings, DPA, SSO

Not stated Not stated.

Notes

Open questions

Questions the captured policies leave unanswered, and where the answer probably lives.

Documents read