Before employees enter business information into an AI tool, they should be able to answer a basic question: does AI use my data for training? The answer can depend on the specific product, account type, feature, and settings in use. A general statement on a vendor’s website may not explain how every part of the service handles prompts, uploaded files, or information sent through connected tools.
Use the review below to check what happens to your data and record the answers. The goal is not to assume every AI service works the same way. It is to verify the rules that apply to the tool your organization actually uses.
Start with the exact AI product and account
Before reviewing settings, write down the product name, subscription or plan, account type, and the features employees use. Include connected apps, plug-ins, agents, or third-party models if the service uses them. A personal account and a business account may have different terms, but do not assume that the business version has a particular data protection by default. Verify it.
Check whether employees sign in through an organization-managed account or individual accounts. Confirm who controls the account, who can change its data settings, and whether the organization can see or manage those settings. If a team has more than one way to access the same AI service, review each route separately.
Inspect the product’s data-use controls
Open the product’s settings and look for sections with names such as privacy, data controls, model improvement, training, or chat history. Labels and locations vary. If the control is difficult to find, search the vendor’s official help center for the exact product and account type, or ask the vendor to point to the applicable setting in writing.
When you find a relevant control, record what it covers. Does it apply to prompts, uploaded files, feedback, or all of these? Is it set at the individual-user level or managed centrally? Does it apply to every feature employees use, or are some features treated differently?
Do not treat an option to turn off training as proof that the service deletes information or stops retaining it. Training, service improvement, processing a request, conversation history, and retention are separate questions. A service may need to process input to provide a response, while its rules for retaining that input or allowing review may be described elsewhere.
For a product-specific example of why the exact account and service terms matter, review the Google Workspace FAQ for business and enterprise users. Use vendor documentation for the product you have, rather than applying one provider’s description to another service.
Compare settings with policies and contracts
Next, compare what you see in the product with its privacy policy, terms of service, data processing terms, and any agreement signed by your organization. Look for explicit language about prompts, files, outputs, feedback, and other submitted information. Check whether the terms distinguish between model training and broader product or service improvement.
Pay attention to which document governs your account if the wording differs. A product page may describe general practices, while a contract or account-specific policy may set different terms. Save the relevant links or copies, note when you reviewed them, and ask the vendor to resolve any inconsistency before employees submit sensitive information.
The NIST Generative Artificial Intelligence Profile can also help organizations think about AI use as a risk-management issue, rather than a setting to check once and forget. Keep ownership of the review clear, and revisit it when the product, configuration, or intended use changes.
Ask the vendor direct questions
If a policy is vague, ask specific questions and request answers that apply to your product, account, and feature set. Useful questions include:
- Data use: Are prompts, uploaded files, feedback, or outputs used to train or improve models? Does the answer change by account type or feature?
- Retention: How long are prompts and files kept, and what changes when an employee deletes a conversation or turns off a data-use setting?
- Human access: Under what circumstances can vendor staff review our inputs or outputs? Which roles can access them, and how is that access controlled?
- Subcontractors: Can contractors, subprocessors, or other service providers access or process our data? What rules apply to them?
- Connected services: Do apps, plug-ins, agents, or third-party models receive information we submit? Do they follow the same data-use, access, and deletion terms?
- Deletion and backups: What does deletion remove, how long can it take, and can data remain in backups after it is removed from the active service?
- Location and commitments: Where is data processed or stored, and which written contractual commitments apply to our account?
Ask the vendor to distinguish between what the product setting controls and what is governed by the contract or operational policies. Keep the response with your vendor records. A clear written answer is more useful than a broad assurance that information is protected.
Set rules for sensitive business information
Until the terms are verified, employees should avoid entering confidential customer details, credentials, internal records, or regulated information into an AI service. Removing names may not be enough to make information safe to share if other details could identify a person or reveal sensitive business activity.
Organizations in healthcare, veterinary, legal, financial, education, nonprofit, and public-sector settings should check the requirements that apply to their data and use case before submitting it. For healthcare information, confirm the service and agreement are appropriate for the intended use, including whether a business associate agreement is needed for electronic protected health information. Do not treat a training opt-out alone as confirmation that all applicable requirements are met.
Make the review part of a broader AI use policy: identify approved tools, define what employees may enter, and explain where they can ask questions. Zevonix’s AI acceptable-use policy checklist can help structure those internal rules. For organizations handling regulated data, its overview of IT compliance considerations may also be useful.
Keep a simple review record
For each approved AI service, record the product and account type, features in use, relevant settings, policy and contract links, vendor answers, and the person responsible for reviewing them. Include any restrictions employees need to follow, such as keeping confidential files out of a particular feature.
Review the record when the vendor changes its terms, your organization changes the account or configuration, or employees want to use a new connected feature. A structured vendor management process can help keep those checks connected to the rest of your technology decisions.
Make the decision based on verified terms
To determine whether an AI tool uses your data for training, verify the exact product and account, inspect the relevant controls, then compare them with the policy and contract. Separately confirm retention, human and subcontractor access, connected services, and deletion behavior. If any answer is unclear, pause before entering sensitive information and ask the vendor for written clarification.
Zevonix provides managed IT, managed AI, cybersecurity, and IT consulting services for Daytona businesses. For help aligning AI use with your organization’s technology and data practices, get in touch with Zevonix.