Data Privacy When You Send Documents to an AI: A Practical 2026 Guide

EXPERT GUIDE

Data privacy when you send documents to an AI comes down to four questions, not one: is the content used to train a model, how long is a copy kept, can a human read it, and where does it physically go. Most people answer all four with a hope and paste the contract anyway. This guide explains what really happens to a file once it leaves your machine, which vendor promises are worth relying on, and the minimum document policy a small team can follow without slowing anyone down.

📄 What actually happens to a document after you send it to an AI

An upload is not a glance. Within seconds of pasting a paragraph, attaching a PDF or pointing an assistant at a folder, three copies usually exist: the one on your device, the request body sent to the provider, and a stored record if the product keeps conversation history at all. From there the file passes through a pipeline whose stages behave very differently.

First comes parsing, where text is extracted and images may be run through optical character recognition. Then chunking and embedding, if the product builds a searchable index so it can retrieve your content later. Then inference, where the model reads the fragment in front of it. Around all of that sit the operational systems: safety classifiers, request logs kept for debugging and rate limiting, usage analytics and billing records. If the product offers memory or a knowledge base, there is also a persistent store that survives the conversation.

🔍 Data privacy questions to ask before your team’s first upload

These are the questions that separate a tool you can use for client work from one you can only use for public material. Ask them in writing and keep the answer; a support reply that contradicts the published policy is itself useful information.

• Is my content used to train or improve models, by default or only after I opt out? A default matters far more than an opt-out buried four menus deep, because a default is what you get without remembering anything.
• How long is each class of data kept, and can I delete a specific document? Prompts, uploaded files, indexes, security logs and backups are usually different numbers, and deletion of a file does not always delete the derived index entry.
• Can a human read my content, and under what circumstances? Abuse investigation, quality review and support tickets are the three usual routes. Training and human access are separate permissions, and a strict no-training rule says nothing about who reads your file when something is reported.
• Where is it stored and processed, and who else touches it? A named region, a list of sub-processors, and a clear answer on whether support staff in another jurisdiction can access the data.

🚫 What a no-training-by-default promise covers, and what it does not

The most quoted sentence in AI procurement is some version of “we do not use your data to train our models”. It is worth reading exactly, because the qualifier is where the meaning lives. Z.ai’s GLM Coding Team Plan documentation, for example, states that code, prompts, conversations and related content are excluded from model training by default, and it prints that commitment alongside the administrative controls rather than hiding it in a legal annex. Anthropic’s commercial privacy centre says something similar in plainer words: by default, inputs and outputs from commercial products are not used to train its models.

Both sentences contain the same escape hatch. “By default” describes the standard configuration; it is not a description of what happens when a user presses a feedback button or the terms are revised. Anthropic documents the exception openly: when you report a bug or send feedback, the entire related conversation can be stored and used, with retention measured in years rather than days. A thumbs-down click is a training signal you volunteered.

The second thing a no-training claim leaves untouched is human access. A provider can train on nothing and still investigate an abuse report by reading the conversation that triggered it. Those are different permissions, and the answer you need is the one about review, not the one about training.

⏳ Retention in an AI data privacy policy: temporary is a word, not a number

Retention is the part of an AI data privacy policy that tends to be written in adverbs. “We keep data only as long as necessary” sounds responsible and tells you nothing you can plan around. Ask instead for numbers per data class: conversation content, uploaded files, derived indexes, security and audit logs, backups and aggregates.

Anthropic’s feedback retention is a useful illustration of how much can hide inside one sentence, because the company publishes the figure: conversations attached to feedback can sit in its systems for up to five years. That is a defensible engineering choice for reviewable bug reports, and it is also exactly the kind of number that never appears in a one-line summary of a privacy policy.

Under European data protection rules, personal data must be kept in a form that permits identification for no longer than is necessary for the purposes of the processing. As the controller, you are the one who has to justify the retention window. You cannot justify a number you were never told.

🌍 Where the data goes: regions, sub-processors and transfers

A tool can be excellent and still fail a residency requirement. A transfer of personal data to a third country is permitted when the destination has an adequacy decision, or when appropriate safeguards are in place, such as standard data protection clauses or binding corporate rules, together with enforceable rights and effective remedies for the people whose data it is. A provider whose legal entity is in one country, whose engineering team answers support tickets from another and whose inference runs in a third has created three transfers, not one.

Ask whether you can pin processing to a named region, whether access by support staff is restricted by policy and by system, and what the data processing addendum says about onward transfers. In Brazil, the LGPD’s international transfer rules follow the same logic, so a team invoicing from São Paulo needs the same answers as a team in Lisbon.

⚖️ What the law already requires, before you choose anything

Buying a privacy-friendly tool does not transfer your obligations to the vendor. If you are deciding why and how a document is processed, you are the controller, and the following duties are yours regardless of how good the provider is.

A processor agreement, in writing. Processing carried out on your behalf must be governed by a contract that sets out the subject matter, duration, nature and purpose of the processing, the types of personal data and categories of data subjects, and the obligations of both sides. The processor acts only on your documented instructions, cannot add sub-processors without authorisation, and must tell you without undue delay if it becomes aware of a breach.

Security appropriate to the risk. The standard measures are pseudonymisation and encryption, the ability to keep the processing confidential, intact, available and resilient, and a process for regularly testing and evaluating those measures. Ask how a candidate vendor evidences the last one, because a certification badge is not a test.

A breach path that reaches you in time. A controller must notify the supervisory authority without undue delay and, where feasible, within 72 hours of becoming aware of a qualifying breach. That clock starts when your provider tells you, so the processor agreement’s notify-without-undue-delay clause is what protects the deadline.

Accountability you can demonstrate. Whatever you assessed must be showable later: which tool, which class of document, which terms, which decision. A short written record per tool is enough for most small teams, and a formal impact assessment is expected where the processing is likely to be high risk.

🧭 A document policy people will actually follow

The reason informal AI use spreads is that the official process is slower than the task. A workable policy therefore has to be a lookup table rather than a judgement call, because at the moment of upload nobody wants to reason about lawful bases.

Document class	Where it may go	Conditions
Public or marketing material	Any tool, including free tiers	None beyond common sense
Internal documents: code, plans, drafts	Business or API tier only	No-training default and named seats, not a shared login
Client personal data	Business tier with a signed processor agreement	Retention window known, transfers covered, client contract permits it
Health, financial, minors or other regulated data	Not in general-purpose AI tools	Written assessment and legal review before any exception

Two habits make the table survive contact with a deadline: minimise before you paste, because a two-line question about a contract is not the same upload as the contract, and write down the exceptions when you make them, since the exception you cannot remember is the one that will matter later.

🛠️ Why admin controls are privacy controls, not just billing features

The business tiers that appeared across the AI market in 2026 are usually sold on cost governance, and their privacy value is easy to miss. Take a documented example in the coding-agent space: Z.ai for Business, the GLM Coding Team Plan, which bundles a no-training-by-default statement with seat and budget administration. The plan assigns seats one-to-one with named members who can be reassigned as staff change, shows usage and consumption by member and period, lets an administrator enable on-demand overage with per-member spending limits, and consolidates billing so that verified enterprises can request VAT invoices.

Read that list again as a security engineer rather than a finance officer and the privacy logic appears. Named seats mean the shared login disappears, and a shared login is the most common way a document ends up attributed to the wrong person; this plan forbids sharing outright and enforces it through risk control. Usage visible by member is how you notice that someone pointed an agent at the wrong repository while there is still time to react. A spend ceiling caps the blast radius of a runaway agent, and a runaway agent is a data-exposure incident before it is a budget incident. And a no-training default is only auditable if somebody, somewhere, can see which seats exist.

The friction is worth stating plainly: the Team plan has a two-seat minimum, Standard and Premium seats cannot be mixed, a Standard seat cannot be upgraded mid-term, and reducing seats means waiting for the billing cycle to end. Seat pricing is not published in the public documentation we analysed, so confirm it in the console before signing.

🚩 Red flags that should stop a rollout before it starts

Improvement language with no training sentence. A policy that says it may use content “to improve our services” and never separates training from bug fixing has told you the answer it did not want to write down.

Opt-out instead of a default. If protecting client documents depends on every employee finding a settings toggle, it will not happen, and the failure will be invisible until the day it matters.

A consumer product behind a business invoice. If the invoicing is professional and the terms are consumer, the content is governed by the consumer terms no matter what the purchase order says.

❓ Frequently asked questions

Document privacy with AI is a boring discipline made of specific numbers: which stages keep a copy, for how long, who can read it, and where it sits. Get those four answers in writing, put a one-page table in front of the team, and prefer a tier where seats belong to people and training is off by default. That is a far better position than a policy nobody reads and an assistant nobody can audit.

⭐ READ OUR FULL REVIEWFeatures, pricing and our honest verdict →