#AFFILIATE-PLACEHOLDER-* in our code) until we join programs — at which point every affected page gets a clear, conspicuous disclosure. Full disclosure.Freelancers paste client data into AI tools all day: draft contracts, customer lists, financials, medical copy, unreleased product plans. Whether that paste ends up training someone else's model depends on which plan you're on — and the defaults are different at every provider. This guide is built on published 2026 provider policies and independent 2026 privacy reporting. Method: no tool was tested by us; policies below are taken from official provider documentation and cited independent audits. This is not legal advice — if a client contract or NDA governs your data handling, follow the contract. Information last verified: October 2026. Privacy policies change; check the current version before relying on any claim here.
| Plan | Used to Train Models by Default? | Retention | DPA Available? |
|---|---|---|---|
| ChatGPT Free, Go, Plus, Pro | Yes — "Improve the model for everyone" is on by default; switch it off in Settings → Data Controls | Chats kept in history until deleted; deleted chats removed from systems within 30 days; safety monitoring logs up to 30 days | No |
| ChatGPT Business / Enterprise / Edu | No — not used for training by default | Admin-controlled on Enterprise/Edu/Healthcare (default ~30 days); user-controlled on Business | Yes — DPA covers Business, Enterprise, and API (request through OpenAI's form) |
| OpenAI API | No — not used for training since March 2023 unless you opt in | Abuse-monitoring logs up to 30 days; zero data retention (ZDR) available for eligible API customers with approval | Yes |
| Claude consumer (claude.ai) | No — only if you opt in via "Help improve Claude," submit feedback, or a chat is safety-flagged | Inputs/outputs deleted within 30 days; opted-in data can persist in training pipelines up to 5 years | No |
| Claude API | No — never without your express permission | Deleted within 30 days; zero data retention available per organization via sales (not available for Anthropic's "Covered Models" like Fable/Mythos) | Yes |
| Gemini consumer app | Yes — "Keep Activity" is on by default, and activity feeds model improvement | Human-reviewed chats kept up to 3 years even after deletion; turn off at myactivity.google.com | No |
| Gemini API paid tier / Vertex AI | No on paid tiers; the free tier (and unpaid API use outside the EEA/UK/Switzerland) may be human-reviewed and used to improve products | ~55 days abuse-monitoring retention on the paid Developer API; flagged prompts up to 90 days on Vertex AI | Yes (Data Processing Addendum on paid tiers) |
Defaults compiled from provider documentation and independent audits (Janus Compliance, Oct 2026; Security Boulevard, Sept 2026; DataNorth AI; NordVPN, Jan 2026). "Yes" above means training is the default for that tier unless you change a setting — not that every keystroke is definitely training a model.
On Free, Go, Plus, and Pro accounts, OpenAI uses your conversations to train models by default. The opt-out is called "Improve the model for everyone" and lives in Settings → Data Controls — and as one 2026 analysis notes, OpenAI's own help pages are written entirely as instructions for switching it off, which tells you the default. Two details freelancers miss:
Temporary Chat is the closest consumer option to ephemerality: no history, no memories, no training use — but OpenAI still retains the content for up to 30 days for safety monitoring. It's a much better default for client work than a regular chat, just not the zero-retention it feels like.
Anthropic is the opt-in provider of the three: on claude.ai, your chats are not used for training unless you enable "Help improve Claude," submit feedback, or a conversation gets safety-flagged. Note the third exception: a flagged client chat enters the review pipeline. If you did opt in, opted-in data can persist in training pipelines for up to 5 years. On the API side, Anthropic never trains without your express permission, and zero data retention is available per organization through sales — with one exclusion to know about: Anthropic's "Covered Models" (currently the Fable and Mythos families) carry a 30-day retention requirement and cannot run under zero retention at all. One model-string change in a config file can change your contractual data posture without anyone noticing — check which model you're calling.
The consumer Gemini app is the least private default of the three: "Keep Activity" is on, the activity feeds product improvement, and chats routed to human review are kept for up to 3 years even after you delete them. Turning off activity happens at myactivity.google.com/product/gemini, not in the app's settings. And submitting feedback still routes the last 24 hours of chats to human review. On the paid API tiers, the posture flips — no training, with abuse-monitoring retention around 55 days — but the free tier and unpaid API use outside the EEA, UK, and Switzerland can be human-reviewed and used to improve products. Employees who use personal Google accounts for client work inherit the consumer defaults.
Every provider does human safety review. 404 Media reported in September 2026 that OpenAI hires hundreds of contractors to read real user prompts, with a "privacy filter" that attempts to strip personal information first — and sensitive details still slip through. Similar human review happens at Anthropic and Google. Encryption is in transit (TLS) and at rest (AES-256), but not end-to-end: the model has to read your prompt, so the provider holds the keys and can technically access the content. Treat consumer chatbots as semi-public surfaces for anything you paste.
No more than Free is. Plus and Pro share the consumer defaults: training on unless you opt out, no DPA, 30-day retention. If client confidentiality is part of your contracts, you need Business, Enterprise, the API, or at minimum the training opt-out plus Temporary Chat — and ideally a signed DPA.
Mostly, eventually. Deleted ChatGPT chats are removed from OpenAI's systems within 30 days unless a legal or safety obligation requires longer. Deleted Gemini chats that were human-reviewed can be kept up to 3 years. Data already used for training cannot be extracted from a model.
Of the three consumer chatbots, Claude has the safest default (no training unless you opt in or get safety-flagged). It's still not zero-retention, still human-reviewable for flagged chats, and still lacks a DPA on the consumer tier — for regulated or NDA-bound work, use the API with a signed agreement.
OpenAI offers zero data retention for eligible API customers (approval required), and Anthropic offers it per organization through sales — except for its Covered Models (Fable/Mythos families), which always retain 30 days. Even under zero retention, a safety override can apply for severe-risk investigations. Read the row for the specific endpoint and model you call, not just the vendor's headline promise.