AI & automationSmall-business IT

Who Can See What You Type Into AI? A Small-Business Guide to AI Privacy Settings

OpenAI's new business privacy controls mostly cover API customers. For a small business, the settings that matter are already in ChatGPT, Claude and Gemini.

By Cybercave Technologies, LLC · Oct 31, 2026

A black smartphone wrapped in a metal chain and locked with a combination padlock on a dark wooden table — Check who can see your AI chats before you paste in business details. Credit: Photo by Towfiqu barbhuiya via Pexels (Pexels License).

Short answer: On personal AI chat plans, what you type can be kept and used to train the AI unless you turn that off. OpenAI says its business plans and API are not used for training by default. A small business can close most of the gap in one sitting: list every AI account, check one setting on each, and set a short "never paste" list.

Key points

OpenAI announced "Private Intelligence" on Oct. 30, 2026, a bundle of privacy controls for business customers. Its main pieces cover eligible API workflows, one part is still a preview, and OpenAI lists no prices.
On ChatGPT Free, Plus and Pro, sharing chats for model training is on by default, OpenAI's help center says. ChatGPT Business and the API are not used for training by default.
On Claude Free, Pro and Max, Anthropic keeps chats for five years if you allow training, and 30 days if you don't.
On a personal Google account, Gemini chats saved with Keep Activity on can be used to train Google's models, and chats a human reviewer has looked at are kept for up to three years.

What to do this week: list every AI chat account your team uses, note whether it is a personal or business plan, and check its model-training setting.

What did OpenAI announce?

A package of privacy promises for businesses, most of it aimed at companies building on its API. On its Private Intelligence page, OpenAI says businesses own their inputs and outputs, decide what AI agents can reach and when an agent needs a person's approval, and can use Zero Data Retention (ZDR) "for eligible workflows." As OpenAI describes it, ZDR means it does not hold on to prompts or answers once a request is done. A second piece, Private Inference, uses confidential computing to protect prompts while the model works on them and is labeled a preview.

MODEL described the Oct. 30 announcement as mostly existing protections regrouped under one name, plus the new preview. It also noted that OpenAI does not publicly define which workflows are "eligible," how much Private Inference will cost or how long it stays in preview. Tech City Authority said the program was first shown at OpenAI's DevDay 2026 event, citing VentureBeat, and that OpenAI had not yet said what Private Inference will cost or when it will be generally available. MODEL's view is that small teams already using the API won't see their bill or setup change yet.

Does the AI company keep and learn from what you type?

On personal plans, often yes, unless you change a setting. Here is what each company says, as of Oct. 31, 2026:

ChatGPT (personal). OpenAI's data controls page says data sharing is on by default for ChatGPT Free, Plus and Pro. The switch is called "Improve the model for everyone," under Settings, then Data controls. Turning it off keeps your chat history.
ChatGPT Business and the API. OpenAI's enterprise privacy page says it does not train on business data by default. ChatGPT Business admins control how long chats are kept, and deleted chats are removed within 30 days unless longer retention is legally required or needed to protect against harm. API inputs and outputs may be kept for up to 30 days to spot abuse.
Claude (personal). Anthropic's Aug. 28, 2025 update asks Free, Pro and Max users to choose whether their chats train future models. If you allow it, new and resumed chats are kept for five years; if not, the 30-day retention stays. The change does not apply to Claude for Work (Team and Enterprise) or the API.
Gemini (personal Google account). Google's Gemini Apps Privacy Hub says chats saved with Keep Activity on are used to improve its services, including training AI models, and some are read by human reviewers. Saved activity auto-deletes after 18 months by default. With Keep Activity off, chats are held for 72 hours and are not used for training unless you send feedback. Google says work or school accounts may have different terms.

What does this mean for a small business in Southwest Michigan?

The risk is usually not the AI company's newest enterprise feature. It is the owner or an employee pasting a customer's invoice, a bid or an employee issue into a personal account with default settings. Take a hypothetical bookkeeper in Kalamazoo who drafts client emails in a free ChatGPT account: by default, those chats are shared for model training until the setting is turned off.

Business plans change the defaults. OpenAI says ChatGPT Business is not used for training by default, and Anthropic says its consumer training change does not apply to Claude for Work or its API. A paid seat is a cost, so weigh it like any other software bill. Either way, the settings and a simple house rule do most of the work.

How do you lock down AI chat privacy in one sitting?

List every AI account. Ask each person which AI tools they use for work, and whether they sign in with a personal or business account.
Turn off model training on personal accounts. In ChatGPT, switch off "Improve the model for everyone." In Claude, check the model-training choice in Privacy Settings. In Gemini, review Keep Activity and the auto-delete period.
Use temporary chats for one-off sensitive questions. OpenAI says ChatGPT temporary chats are not used to train its models but may be kept up to 30 days for safety. Google says Gemini temporary chats are not used for training and are held for 72 hours.
Skip the thumbs-up and thumbs-down buttons on sensitive chats. OpenAI says rating a response can let the whole conversation be used for training, even after you opt out. Google says that sending Gemini feedback with Keep Activity off shares the last 24 hours of your chats as context.
Write a "never paste" list. Customer personal details, passwords, payment card numbers and employee records stay out of every AI tool, whatever the settings.
Move regular business work to a business plan. If the team uses AI every day, a business workspace usually gives an owner more control. In ChatGPT Business, for example, OpenAI says admins set retention and chats are not used for training by default.

What should you tell your IT provider or developer?

If anything you run calls the OpenAI API, ask whether it qualifies for Zero Data Retention, and remember that by default API inputs and outputs may be kept for up to 30 days. Ask the same retention question of any app that sends your data to an AI model behind the scenes.

What should you do this week?

Do the inventory. In one sitting, list every AI account your team uses, mark each one personal or business, and check its training setting. Fix the defaults today and post the "never paste" list where people work.

For more, see our guides to rolling out AI one task at a time, counting what an AI seat really costs, and checking what your software vendors can see.

FAQ

Does ChatGPT Business train on my company's chats? Not by default, OpenAI says. The same goes for its API. Data you choose to share through its feedback tools can be used.

Does turning off model training delete my old chats? No. OpenAI says the setting does not delete or hide saved chats; delete them separately if you want them gone.

Are temporary chats completely private? Not completely. Neither company uses them for training, but OpenAI says ChatGPT may keep them up to 30 days for safety, and Google holds Gemini temporary chats for 72 hours.

Should a small business sign up for OpenAI Private Intelligence? Most don't need to act. Its main pieces cover eligible API workflows, one is a preview, and OpenAI has published no prices. Checking the settings you already have matters more.

Disclosure: No company named in this article paid for it, reviewed it or saw it before publication. Settings and retention periods are as published by each company and were checked on Oct. 31, 2026; they can change. Not sponsored.