Understand · Data, privacy & security

Data, privacy & security

What happens to what you paste into a chatbot?

Where your text goes, who can see it, and the settings that matter.

6 min readPlain English

Read it in

In one sentence

What you paste goes to the provider’s computers to produce a reply; your plan and settings decide how long it’s kept, who can see it and whether it trains future models.

Think of it like…

It’s like handing a document to a print shop. They have to read it to do the job; what matters is whether they keep a copy, for how long, who in the shop can look at it, and whether they use it to train new staff.

How it works

Here’s the trip your text takes when you press Enter in an online chatbot. Your plan and settings decide what happens at most of the stops.

  1. 1SentYour text travels, encrypted, from your device to the provider’s computers. Any files you attach go too.
  2. 2ProcessedThe model reads it and writes a reply. It doesn’t learn from your chat as you type; what it knows was fixed when it was trained.
  3. 3StoredThe chat is saved to your history, and how long the provider keeps it depends on your plan and settings. Some assistants also save details to a memory they reuse in later chats.
  4. 4Reviewed or reusedDepending on your plan and settings, chats may be used to train future models, or read by the provider’s staff or contractors, for example to check for abuse.
  5. 5DeletedDeleting removes a chat from your history. The provider may keep a copy for a set period, for safety, legal or review reasons, and copies already separated from your account may be kept longer.

Free, personal and business plans can treat each stop differently, and settings change. Check your own plan rather than assuming.

Good at, bad at

Good at

  • Encrypting your text on its way to the provider
  • Helping just as well with names and account numbers taken out
  • Admin controls for a whole team, on many business plans

Bad at

  • Knowing what’s confidential: a password looks like any other text
  • Forgetting fast: deleted can still mean kept for a while
  • Keeping things private once you share a chat link or connect other apps

Where you’ll see it at work

  • A complaint at an online shop. Before asking for a reply draft, the support lead swaps the customer’s name and order number for [NAME] and [ORDER], then puts them back in the final email.

  • A bookkeeper’s tricky question. The figures and the question go in; the client’s name and account details stay out. The answer is just as useful.

  • One login, shared by five. A design studio moves from a shared personal account to a business plan, so an admin controls the data settings and everyone has their own chats.

Myth vs reality

Myth: “Everything I paste trains the AI.”

Reality: It depends on your plan and settings. Many business plans don’t use your chats for training by default; free and personal plans often can unless you switch it off. And training is only one question: how long chats are kept and who can see them matter too.

Words to know

Data retentionTraining dataPIIChatbotAPI
Test yourselfNo grades

You want help replying to a complaint that includes the customer’s full name and order number. What’s the safest way to start?

In the news this week

From understanding to doing