What happens to customer data you paste into an AI tool

Somebody in your business is pasting client information into an AI tool right now. A complaint email to be softened, a contract to be summarised, a spreadsheet of names to be tidied. They are not being reckless; they are being efficient with the tools they have.

The question worth answering is not whether to allow it. It is what the tool does with what it is given, which is documented, and different from what most people assume in both directions.

This is not legal advice, and it does not tell you what your obligations are — those depend on where you and your customers are. It is about what the vendors themselves say, read in August 2026, on pages that change.

"Not trained on" and "not kept" are different promises

The reassurance people repeat is that business tools do not train on your data. For the two vendors whose documentation I read, that is broadly what they state — and it answers a narrower question than most readers think.

Anthropic's page on model training says: "By default, we will not use your inputs or outputs from our commercial products (e.g. Claude for Work, Anthropic API, Claude Gov, etc.) to train our models."

OpenAI's documentation for API data says that "data sent to the OpenAI API is not used to train or improve OpenAI models (unless you explicitly opt in to share data with us)", a policy it dates to 1 March 2023.

Now the part that gets skipped. OpenAI also documents that, by default, abuse monitoring logs containing customer content are retained "for up to 30 days, unless longer retention is required by law", that retention varies by endpoint — some application state persists "until deleted" — and that a Zero Data Retention mode exists for customers who need content excluded from those logs.

So the accurate summary is: the content is not being used to build the model, and it is not necessarily gone either. Those are separate commitments, and a sentence about training answers only the first.

The free tab and the paid one are different products

The most consequential distinction is the least visible, because both look like the same box on the same website.

Anthropic's page is explicit that it covers commercial offerings, and points elsewhere for the consumer tiers — the same company documents its defaults differently depending on which product you are in. OpenAI's statement above is about the API specifically.

For a small business this is the whole practical issue. Your staff member is almost certainly not in the commercial tier. They are in whatever they signed up for personally, with their own email, on the free plan, on their own laptop. Whatever guarantees you read about the business product do not describe that tab.

There is a second edge on the same page. Anthropic documents that if you "explicitly report feedback or bugs to us (e.g. via our thumbs up/down feedback button), or otherwise choose to allow us to use your data, then we may use your chats and coding sessions to train our models." A person who clicks the thumbs down because an answer was unhelpful has, on that vendor's terms, changed what happens to that conversation. Nobody reads that button as a consent form.

The rule of thumb that outlives the policies

These pages change, and they will have changed by the time this matters to you. So rather than memorising terms, use a test that does not depend on them.

Would you be comfortable if this text appeared in a third party's logs for a month? Not on the internet — in a vendor's systems, readable by their staff under some circumstances, for some period. That is the realistic risk, and it is a question you can answer without a lawyer.

For most day-to-day work, the answer is yes and nothing more is needed. For some, it obviously is not: medical details, a client's financial position, legal matters told to you in confidence, anything covered by an NDA you signed, identity documents, credentials.

The middle case is where small businesses actually live, and it is usually solved by removing what makes the text identifiable. "Draft a firmer reminder for an overdue invoice, £4,200, sixty days late, client is a long-standing one" gets you the same answer as the version with the name, the address and the account number in it.

What to do about it this week

Ask what people are already using. Not to stop it — to know. The answer will include at least one tool you had not heard of, and that is the point of asking.

Decide the categories, not the tools. A list of banned products is out of date immediately. "Client names and account numbers do not go into any external tool" survives the next launch.

Put the paid tier on the company account. If the work is genuinely useful, the version with a business agreement, administered by you rather than by somebody's personal login, is not expensive and moves the question onto ground you control.

Say something about the feedback buttons. Given the exception above, it is worth a sentence in whatever guidance you write.

Write it down in a paragraph. A policy nobody reads is still better than an unspoken assumption, because it converts "I did not know" into a decision somebody made.

Where this stops being about tools

The pasting is the visible half. The half that outlasts it is the automation that sends data to an AI service continuously — a workflow that summarises every inbound email, classifies every support ticket, or drafts a reply to every enquiry. Nobody chooses what goes into those. Every record does, including the ones that would have failed the test above.

That is a design decision rather than a habit: which fields are sent, whether they are stripped first, which tier the connection uses, and whether anything is retained on your side. It is worth answering before the workflow is built rather than after a client asks where their information went.

Sorting out what your processes currently send, and to whom, is one of the things a process audit covers: $299, three business days, and a written account of what leaves your systems.

Sources

I read these pages in August 2026. Vendor policies change, and these two are not the whole market — I have deliberately not described vendors whose documentation I did not read.

Whether commercial inputs are used for training, and the feedback-button exception: Anthropic on whether your data is used for model training.

Training, retention windows and Zero Data Retention: OpenAI's data controls documentation.

Related: whose accounts does your automation actually run on? covers the neighbouring question of which logins your systems use and what happens when one goes away.