Data Privacy Opt-Out Guide

How to stop AI tools training on your conversations, and what to check beyond that switch.

Menu labels move between releases. The settings below are named by what they do, so search your tool's settings for the concept rather than an exact string.

The one setting that matters most

Every major assistant has a control that decides whether your conversations can be used to improve the model. It is usually found under Settings → Data Controls, Settings → Privacy, or Account → Data.

Look for wording like:

• "Improve the model for everyone"
• "Use my data for training"
• "Help improve our models"
• "Share conversations with the provider"

Turn it off. Note that:

• It is usually on by default on free and personal-paid tiers.
• It usually applies going forward only — past conversations may already be retained.
• It sometimes resets after major account or plan changes. Re-check monthly.

What "off" does not mean

Turning off training is not the same as the data not being stored. Distinguish three separate things:

	What it means	Typically controlled by
Training	Your text may be used to improve future models	The toggle above
Retention	Your text is stored for some period regardless	A separate retention setting, or the plan you are on
Human review	Staff may read flagged conversations for safety or abuse	Usually not optional

Most providers retain conversations for a period even with training off, typically for abuse monitoring. Enterprise agreements are where zero-retention terms usually live.

Tier by tier

Free tiers. Weakest guarantees. Training is often on by default and the terms give the provider the widest latitude. Treat anything you paste as potentially readable by someone else. Fine for public information and generic drafting; not for client data.

Personal paid tiers. Better. Training can usually be disabled and retention is often shorter. Still governed by consumer terms, not a contract you negotiated. Fine for most professional work that is not confidential.

Team and enterprise tiers. Usually contractually excluded from training by default, with admin-controlled retention and an audit trail. This is the tier you need for client data, regulated data, or anything covered by an NDA.

Local models. Nothing leaves your machine. The strongest privacy position available, at the cost of capability and setup effort. Worth knowing about for genuinely sensitive work — ollama.com is the usual starting point.

Your audit

Do this once per tool, then re-check on the first of the month.

Tool	Tier	Training off	Retention period	Connected apps reviewed	Date checked

Beyond the toggle

• Review connected apps and integrations. Anything you granted access to your email, calendar, or files. Revoke what you no longer use.
• Check shared conversation links. Several tools let you publish a conversation by link. Those links are often public to anyone who has them, and sometimes indexable. Audit what you have shared.
• Delete conversations you do not need. Deleting in the app is not always immediate at the backend, but it is strictly better than not deleting.
• Separate accounts. Work email for work tools. Do not use a personal account for client work — it puts client data under your consumer terms.
• Check the mobile app separately. Settings do not always sync, and voice input may be handled under different terms.
• Read what your employer requires. If there is an approved tool, use it. "But this one is better" is not a defence when data leaves an approved boundary.

If you are handling other people's data

Anonymise before pasting. A simple, reliable substitution:

Replace before pasting:
  Real name      -> [PERSON_1], [PERSON_2]
  Email          -> [EMAIL_1]
  Phone          -> [PHONE_1]
  Company        -> [COMPANY_A]
  Account/ID no. -> [ID_1]
  Address        -> [ADDRESS_1]

Keep a mapping in a local file. Substitute the real values back into the
final output yourself.

This takes a minute and converts "I pasted a client's personal data into a chatbot" into "I processed an anonymised extract".

For anything under GDPR, India's DPDP Act, HIPAA or similar, anonymisation is a mitigation, not a blanket permission. Check your obligations before automating anything involving personal data at volume.

The test to apply

Before pasting, ask: if this conversation were published tomorrow with my name on it, what would happen?

If the answer is "nothing", proceed. If the answer makes you wince, anonymise it or use a tool with the right guarantees.