The question people ask is "do they train on it", and the answer to that question — even when it is a clear no — leaves most of the picture unaddressed. A file that is never trained on can still be stored for a month, replicated to backups, read by a human reviewer, processed by three companies you have never heard of, and survive the deletion of the conversation that referenced it. None of that is sinister. It is just the part nobody reads.
The five separate questions
People ask one and assume it answers all five. It does not.
1. Is it used for training? 2. How long is it stored? 3. Who can read it? 4. Which other companies process it? 5. What does deletion actually remove?
A "no" to the first tells you nothing about the other four.
The tier is the answer, not the brand
The single most useful thing to understand: the same company usually offers materially different data terms depending on how you access the model.
| Consumer chat | API / Enterprise | |
|---|---|---|
| Training on your data | Often default-on | Generally not by default |
| Opt-out available | Usually, in settings | Not needed by default |
| Retention | Long, account-linked | Short, often ~30 days |
| Zero retention | No | Sometimes, on request |
| Contractual data terms | Consumer ToS | A negotiable DPA |
This is why "is it safe to upload to X" is not answerable as asked. The free consumer version and the enterprise agreement from the same vendor can differ on every row. Before uploading anything that matters, establish which one you are actually on — and note that a personal account used for work is the consumer tier regardless of who is paying.
⚠️ Consumer accounts used for work are the common failure
The realistic corporate exposure is not a negotiated enterprise contract with unfavourable terms. It is an employee pasting a client document into a personal free-tier account because it was quicker than raising a ticket.
That upload sits under consumer terms, on a personal account, outside any audit trail the organisation has. Providing a sanctioned tool with acceptable terms removes the incentive far more effectively than a policy telling people not to.
The lifecycle of an upload
Two stages routinely surprise people.
Stage 2 — uploaded files often have their own retention independent of the chat. Deleting the conversation may leave the file in object storage under a separate policy. If a provider documents file retention separately from conversation retention, that is why.
Stage 6 — "we do not train on your data" and "no human ever sees it" are different promises. Abuse monitoring exists to catch genuinely harmful use, and it generally involves the possibility of human review. Most providers document this; almost nobody reads it.
The other companies involved
Your data rarely touches only the model provider. A typical chain includes cloud hosting, possibly a separate inference platform, content moderation services, and error or observability tooling.
This is normal and disclosed — providers publish sub-processor lists — but it matters for two practical reasons: it expands the set of parties and jurisdictions involved, and it is the level at which questions about international transfers actually get answered. If you have a data residency requirement, the sub-processor list is the document to read, not the marketing page.
What deletion does and does not do
That last line is the one worth internalising, because it is a hard technical limit rather than a policy choice. Training distributes a document's influence across billions of parameters with no index back to the source. There is no operation that subtracts one file's contribution — the only remedies are retraining from scratch or not having included it.
Which reframes the decision usefully: the training question is the only irreversible one. Retention expires, access is auditable, sub-processors change. Training does not undo. Get that one right before uploading and the others become manageable.
💡 How to read a policy in five minutes
Search the document for these five words rather than reading it front to back: train, retain, delete, human, sub-processor.
Then check that what you found applies to your tier. The most common mistake is reading enterprise documentation and using a consumer account — the terms you found are real and they are not the ones you agreed to.
Reducing exposure without stopping
The realistic goal is sending less, not sending nothing.
- Send the extract, not the document. If the task needs three clauses, send three clauses. This is the single largest reduction available and it improves results as well — the model is not distracted by forty irrelevant pages.
- Strip metadata before uploading. Author names, file paths, revision history and GPS coordinates travel with files and are rarely relevant to the task. Often more identifying than the content.
- Pseudonymise where the task allows. Replace names with tokens, map back afterwards. Preserves utility, removes the identifying part.
- Do the preprocessing locally. Extraction, redaction and conversion do not need a cloud service. Anything done in the browser never leaves the device at all.
- Match the tier to the sensitivity. Not everything needs the enterprise agreement; some things need it absolutely.
The practical mechanics of the second and third points are in how to redact a document before sending it to an AI, which is a harder problem than it looks — covering text with a black box does not remove it.
🚨 Specifics change; check before you rely on them
Retention windows, default training behaviour and tier structures are commercial decisions that providers revise, sometimes materially. Anything stated here as typical is a pattern, not a current fact about any named service.
For a decision that matters, read the provider's current documentation for the exact tier you are on, and check the date on it. The durable part of this article is the five questions and the lifecycle — those hold regardless of whose policy you are reading.
Preparing files before they leave your machine?
Extract, convert and strip metadata entirely in your browser — nothing is uploaded to a server.
Open EXIF Remover →Summary
- Five separate questions: training, retention, access, sub-processors, deletion.
- The tier decides, not the brand. Consumer and API terms differ on every point.
- Personal accounts used for work are the realistic corporate exposure.
- Files often have separate retention from the conversation that used them.
- No training is not the same as no human review.
- Sub-processor lists answer residency questions, not marketing pages.
- Training is the only irreversible step. Weights cannot be un-trained.
- Send extracts, strip metadata, preprocess locally.
Frequently Asked Questions
Do AI companies train on files I upload?
It depends almost entirely on which tier you are using. Consumer chat products have historically defaulted to using conversations for improvement, with an opt-out; API and enterprise tiers generally do not train on customer data by default. The product name is not the answer — the tier and its terms are.
Does 'we don't train on your data' mean the data is not stored?
No. Those are separate commitments. A provider can decline to train on your data while still storing it for a retention period, backing it up, and allowing staff to review it under abuse-investigation processes. Read for retention and access terms specifically, not just training.
How long do AI providers keep uploaded files?
Commonly around 30 days for abuse monitoring, even under agreements that promise no training. Zero-retention arrangements exist on some enterprise contracts but usually have to be requested rather than being the default, and files may be stored separately from conversations with their own timeline.
If I delete a conversation, is the file gone?
Not necessarily and not immediately. Deletion typically removes it from your view and starts a backend process, while backups may persist for a further period and uploaded files are sometimes stored separately from the conversation that referenced them. Anything already incorporated into trained weights cannot be removed at all.
Can uploaded data be removed from a model that trained on it?
No. Training distributes influence across billions of parameters with no index back to source material, so there is no operation that removes one document's contribution. This is why the training question is the one worth getting right before uploading rather than after.