What happens to what you type into an AI

“Is it safe to paste this into the AI?” is one of the most common questions people ask about these tools, and it rarely gets a straight answer, because it is really five questions bundled together. This post separates them. It does not summarise any particular company's policy: those change, differ between products from the same company, and are the thing you should check yourself. Instead it gives you the map and the questions, so you can read any policy and know what it does and does not promise.

When you type a prompt and press enter, your text usually passes through several systems, each of which may keep a copy for a different reason and for a different length of time.

The app you are using and the company that runs the model are often different businesses. A writing assistant, a note-taking app or a customer-service bot may send your text to a model provider behind the scenes. That means there can be two sets of terms that apply: the app's, and the provider's terms with the app.

1. Processing. The model reads your text to produce an answer. This is called inference and it is unavoidable: there is no answer without it. Processing alone does not mean storage.

2. Retention. A copy is kept after the answer is sent, for a period: your chat history, server logs, or a safety-review store. The useful question is not “do you keep it?” but “what, where, for how long, and who can read it?”. Retention of a few weeks for abuse monitoring is a different promise from keeping chats until you delete them, which is different again from keeping them after you delete them.

3. Human review. Some services let staff or contractors read a sample of conversations, for safety investigations or to rate answer quality. Policies usually say whether this happens and whether the sample is de-identified.

4. Training. Your conversations become part of the training data for a future model. This matters because models can, in rare cases, repeat pieces of their training data word for word: researchers showed in 2021 that verbatim snippets, including personal details, could be extracted from a public model. Once text is trained into a model it cannot easily be removed again, so this is the decision that is hardest to undo.

5. Indexing. Your files or messages are stored in a searchable form so the AI can look them up later. This is how “chat with your documents” works, using a technique called retrieval-augmented generation, and it is also how some assistants remember things about you across conversations, which is called memory. An index is not training, but it is a long-lived copy of your content.

Most AI companies offer different terms for personal accounts and for business or enterprise accounts, and the difference is often larger than people expect. Business agreements commonly offer things like no training on customer data by default, shorter or configurable retention, data kept in a chosen region, and audit logs for administrators. Personal accounts may offer some of these as settings you must turn on, or not at all. Which applies depends on how you signed in, not on what you typed.

Practically: if your employer provides an AI tool under a business agreement, work data generally belongs there, not in a personal account on the same service. Pasting a client contract into a personal account can put it under very different terms, even if the product looks identical.

Workplace AI tools increasingly search shared drives, wikis and email to answer questions. The important question there is permissions. A well-built system checks, at the moment of searching, whether you are allowed to see each document, using the same rules as the original system. That is called an access control list check. A poorly built one copies everything into a single index and lets anyone's question reach anyone's files.

There is a second risk unique to AI search. If the tool reads a document or web page containing hidden instructions, the model may follow them, a problem known as prompt injection. Researchers demonstrated in 2023 that instructions planted in content an assistant reads can make it leak information. This is why careful products limit what an assistant can do with what it reads.

You do not need to read a fifty-page policy cover to cover. You need answers to these, for the exact product and account type you will use.

• Find the actual terms, not the marketing page: the privacy policy, the terms of service and, for work accounts, the data processing agreement.
• Check the settings page for separate switches for training, history and memory, and note which are on by default.
• Under laws such as Europe's GDPR, you can ask a company what personal data it holds about you and request deletion. That right covers chats and stored memories.
• When in doubt, remove the sensitive part. Replace names, account numbers and health details with placeholders before pasting. Some tools do this automatically, which is called PII redaction.