The short answer
Whether your data is safe with AI depends on which tier of which product you are using and what you opted into when you signed up. The default behavior of free consumer tiers is generally that your inputs may be used to improve the model. The default behavior of paid API and enterprise tiers is generally that they are not. Local AI is the only configuration where the question is structurally moot.
What "my data" actually means
The phrase "my data" hides several different categories. Distinguishing them is the first step to making sensible decisions:
- Conversation content: what you typed and what the model said. The most-asked-about category.
- Connector content: documents, emails, calendar entries the AI read on your behalf. Often more sensitive than the conversation itself.
- Metadata: when you ask, from where, on what device. Aggregated, this profiles you.
- Voice: if you used voice input, the audio is its own asset.
- Inferences: what the model concluded about you based on the above. Hardest to govern, often the most valuable to advertisers.
A reasonable privacy posture treats these categories separately. Free-tier voice input on a connected speaker is a different risk profile than typing a question into a paid Pro account, even if the literal words are similar.
The four levels
- Free tier (ChatGPT free, Gemini free, Claude free, Perplexity free). Assume your inputs are training data unless you find and toggle the opt-out. Some labs honor the opt-out faithfully. None of them have published court-defensible audit trails of what they did before you toggled it.
- Pro / Plus tier ($20-30/month). Generally no training on your data, by current policy. Policy can change. Read the terms when you renew.
- API and Enterprise tier. Contractual no-training. Verifiable in writing. Different SOC2, GDPR, and HIPAA postures depending on vendor.
- Local. The model runs on your hardware. Nothing leaves the network unless you specifically configure an outbound call. The privacy question becomes a network configuration question, which is a question we know how to answer.
The Samsung case
In 2023, Samsung engineers pasted internal source code into the free tier of ChatGPT to debug a problem. Samsung banned ChatGPT and similar tools company-wide within weeks. JPMorgan, Amazon, Apple, Verizon, and Bank of America followed with similar restrictions. The principle: anything you put in the free tier may be used to train a future model. That is not a vulnerability to be patched. It is the business model of the free tier.
The NYT v OpenAI implications
The New York Times v OpenAI MDL has surfaced evidence of GPT-4 reproducing copyrighted Times articles near-verbatim on demand. That tells you what the model retains from training data. If a model can reproduce a Times article, it can reproduce something else. The training set is not a black box; it is a partial transcript.
Air Canada and corporate liability
Air Canada was held liable for what its chatbot promised a customer. The principle generalizes: if you deploy a chatbot that interacts with customers, you own what it says. Whatever data the chatbot has access to may be referenced or leaked into responses. We bound the data scope tightly on every customer-facing deployment.
The tier matrix we configure for clients
The matrix we use, simplified:
- Casual personal queries (recipes, travel ideas, what is the weather): any tier is fine.
- Personal communication drafting: Pro tier with training opt-out, or local.
- Business operations (calendars, drafts, internal docs): API or Enterprise tier.
- Client-confidential work (legal, financial, medical, regulated): Enterprise tier with BAA / DPA in place, or local. Free tier is malpractice.
- Family financial information, biometric data, security credentials: local only.
FIELD NOTE
The clearest defense for a busy household is a router that sends the right query to the right tier automatically. We configure that. The user never has to remember which tier covers what.
Local fallback for sensitive data
For clients who handle truly sensitive information (family office work, regulated professional practice, confidential client matters), we deploy a local LLM (Llama 4 Maverick on a Mac Studio is our default) and route the sensitive subset of work to it. The router can be invisible to the user; from the chat interface, the user types a query, and the system decides whether to handle it locally or in the cloud based on documented rules. See Build It Yourself for the architecture.
What we tell every client
Three rules:
- Assume free tier means free training. If you would not paste it on Reddit, do not paste it in a free chatbot.
- Read the terms when you upgrade. Pro tier policies change. Enterprise contracts override defaults; have your counsel review them.
- For anything you genuinely care about, default local. The cloud is a tool, not the only tool.