The shape of it. Always check the wording against the vendor's own current terms.

Tiers and what happens to your data

The fastest-moving content on this site, and the most important. Treat the principles as durable and every specific as checkable.

By Nauman Hashmi

Reviewed September 2026. This page names fast-moving vendor detail, so it carries a review date.

The five questions, and where the answer lives

What you are asking	Where to find the answer	Why it changes the decision
Is this account personal or business?	The billing or workspace screen, not the logo in the corner.	It decides who controls the settings below, and whether anyone but the user can see or revoke them.
Does what I type train the model?	The data controls or privacy settings screen.	The default is not the same on every tier of every product, which is the part most people get wrong.
How long is it retained, and by whom?	The vendor's published retention terms, not the marketing page.	Deleting a conversation and deleting the record behind it are not always the same action.
Where is it processed?	The terms, or the enterprise documentation if there is one.	It is the question your own obligations are most likely to have an opinion about.
Can the business get the answers in writing?	Ask. A vendor that will not put it in writing has answered.	An instinct is not something you can hand an auditor.

Ask these of any tool, not just the two taught here. The answers differ between vendors and between tiers of the same product.

Why the tier is the whole question

Vendors have historically treated consumer free tiers differently from paid and business tiers, particularly on whether content may be used to improve models, how long it's retained, and who inside the company can review it. That is a different risk profile, not a different price.

Which matters because unofficial workplace use happens almost entirely on personal free accounts. A clinic can have an excellent privacy policy and six staff on consumer accounts at the same time.

How to read this page

We deliberately don't reproduce vendor terms here, because they change and a stale copy is worse than none. The durable part is the set of questions to ask and the decision to write down. The current answers get confirmed against the vendor's own terms at the start of every engagement.

The five things to establish, per tool and per tier

Is content used to train or improve models, and can that be turned off?
How long is it retained, and what happens on deletion?
Who can review it, and under what circumstances?
Where is it processed and stored, and does that matter for your obligations?
Is there an administrator who can see, export or control staff activity?

What to do with the answers

Pick one approved tool and tier, and say so in writing.
Provide the account rather than expecting staff to buy it. Unfunded policies get ignored.
Name the tasks that are allowed on that account, and the ones that aren't allowed anywhere.
Re-check when the vendor changes terms, and date the document.

The vendor-agnostic version

The same five questions work for Copilot, Gemini, a transcription service or a practice management vendor adding “AI features” — questions to ask any AI vendor.

Why this page names no vendor terms

Because they would be wrong within a quarter, and a privacy answer that's stale is worse than no answer. What's durable is the five questions; the current answers get confirmed at the start of every engagement, for the tier you're actually on.

Is what I type used to train the model?
How long is it retained, and where?
Who inside the vendor can see it, and in what circumstances?
Where is it processed?
Can an administrator turn any of this off — and would you know if someone turned it back on?

The fifth separates a business account from a personal one. A setting any user can change is not a control.

Reviewed September 2026. This page describes how we teach these tools, not what either vendor's current terms say — those get confirmed at the start of every engagement.

Why the free tier is where risk collects

Not because free tiers are careless, but because of who uses them and for what. A free account is a personal account: personal email, often a personal phone, no administrator, no record, and nothing happens to it when someone changes roles or leaves.

That's the real exposure — not that a vendor does something sinister with a paragraph of a client letter, but that you have no visibility, no control and no record, for work done on your behalf. The longer version is in free tier, paid tier.

If you don't currently know which accounts your team is on, that's the first thing an audit establishes.

Start an enquiry

The questions we get asked about this

Is the paid tier safe for client information?

Safer is not the same as safe. The tier changes what the vendor does with your text; it doesn't change your obligations to the client, your professional body, or the person whose information it is.

Can we use the free tier for non-sensitive work?

Often yes, and we'll say so when it's true. The risk isn't the free tier itself — it's that the line between sensitive and non-sensitive work gets blurry at 6pm on a deadline.

How current is this page?

It carries a review date, and deliberately doesn't reproduce vendor terms. Treat it as the questions to ask, not the answers.

Get a training plan built for your business. Nine questions about how your business actually runs. You get a plan ordered for your work, a reading on where you're exposed, and one clear place to start. No account needed. Build your plan.