What Actually Happens to What You Paste

Two wrong beliefs cause most of the trouble. The first is that anything typed into an AI tool is instantly public. The second is that it vanishes the moment you close the tab. Neither is true, and the accurate picture is more useful than either.

The path your text takes

1. It leaves your device over an encrypted connection to the provider
2. It is processed, and the response comes back
3. It is usually stored — as your conversation history, and separately in operational logs
4. Depending on the product and plan, it may be reviewed by humans for safety or quality
5. Depending on the product and plan, it may be used to improve models

Steps three, four and five are where the differences live, and they differ far more between plans of the same product than between products.

Consumer plans versus business plans

This is the single most important distinction, and it is invisible in the interface — the same tool, the same screen, materially different handling.

• Free and personal plans commonly default to using conversations for model improvement, with an opt-out somewhere in settings
• Business, team and enterprise plans generally do not train on customer content by default, and say so contractually
• API access is usually the strictest tier, often with defined retention windows
• Retention periods differ: some delete within days, some keep for a month, some keep until you delete

Risks that are real

• Data leaving your organisation's control into a third party you have no contract with — the most common actual compliance breach, and it happens through free accounts
• Personal data about customers or staff being processed without a lawful basis or a data-processing agreement, which is a regulatory problem in the EU, UK and a growing list of jurisdictions
• Confidential material breaching an NDA that says nothing about AI but says a great deal about disclosure to third parties
• Credentials and keys pasted into a prompt while debugging, which then exist in a log you cannot reach
• History on shared or personal devices where a colleague or a family member can read it

Risks that are overstated

• Your exact text appearing verbatim in someone else's answer. Models generalise from large corpora; this is not how they work, and repeating it costs you credibility in the conversations that matter
• Any use at all being a breach. Non-sensitive drafting, summarising public documents and rewriting your own text are low-risk on any plan
• Local models being automatically safe. Data staying on the device removes the third party, not the confidentiality obligation or the access control problem

The five minutes worth spending

1. Open the settings of the tool you use most and find the training or data-controls toggle
2. Check which plan you are on — the answer often differs from what you assumed
3. Find the stated retention period in the terms
4. Turn off history for anything you would not want stored, where the tool supports it
5. Note whether your organisation has a signed agreement with the provider. If not, you are the contract