Before uploading a draft: AI writing data controls to check

Quick answer: four questions before upload

Before sending an unpublished draft, establish whether its content can train models, how long copies remain, who can access them and how deletion works. Record the exact application or API, account type, workspace and optional tools involved. A paid subscription or a training opt-out answers only part of the question.

If your organization's approval requires a control you cannot verify, pause the upload. Use a public or carefully sanitized sample instead. This is a practical screening process, not a legal determination that a service is suitable for regulated or confidential work.

Map the route and minimize the material

Write down the path from your editor to the receiving service. A browser extension, third-party writing app and model-provider API may be different participants. Review the intermediary's policy as well as the underlying provider's. Check whether connected search, document sources, feedback reports or shared links change where content goes.

Then reduce the submission to what the task needs. Remove client names, personal identifiers, credentials, tracked comments and irrelevant attachments. Replacing a name alone may not anonymize a recognizable project. Keep the original locally or in your approved repository, and label the sample so nobody mistakes placeholders for publishable facts.

ChatGPT and OpenAI API: distinguish training from storage

In ChatGPT, turning off Improve the model for everyone prevents new conversations from being used for model training; they can still remain in history. Available controls depend on account and workspace settings.

For the API, OpenAI says content is not used for training unless you opt in. Its data-control documentation separately describes default abuse logs retained up to 30 days, with legal and harm-prevention exceptions. Responses application state is ordinarily retained for at least 30 days, while endpoint and configuration exceptions matter. Zero Data Retention requires approval and has limitations. Check files, stored conversations and tools separately; do not read a training restriction as immediate deletion. See the catalog scope notes.

Claude: consumer choices and commercial terms differ

Anthropic's commercial terms prohibit training on customer content from the covered services. For consumer Free, Pro and Max accounts, separate training rules cover improvement choices, safety review and feedback. Feedback can include the related conversation. Its consumer retention page allows up to five years in training pipelines for new or resumed chats after improvement is enabled, with additional exceptions.

The API's standard deletion period is within 30 days, subject to exceptions and agreements. Certain covered models have additional retention rules for ZDR organizations, with eligibility exceptions. Confirm the actual model and workspace rather than relying on a provider-wide label. Our Claude entry identifies the commercial boundary.

Grammarly and Jasper: read the precise promise

Grammarly's training-control documentation says content-based improvement is on by default for individual Free, Premium and single-user Pro accounts. Users can opt out; other account types have different controls. Turning it off does not stop all non-content statistics processing. Check the account currently active in your writing surface, especially when switching between personal and team work.

Jasper says it prohibits third parties from training their models on customer data. That statement alone does not settle Jasper's own improvement uses or establish a retention schedule. Our research leaves those details unresolved. Consult the Grammarly and Jasper privacy records, then obtain the applicable policy or contract before submitting material that requires stronger controls.

Gemini API and AI Studio: classify the service correctly

The Gemini API terms distinguish unpaid and paid services. Under the unpaid rules, submitted content and responses may support product improvement, including human review; Google warns against submitting sensitive, confidential or personal information.

Paid-service prompts and responses are not used for product improvement, but limited safety-related logging remains. The same paid data-use rules apply in the EEA, Switzerland and UK even for unpaid access. AI Studio can also count as a paid service when the account has access to a project with active Cloud Billing or is a Workspace enterprise account. Verify the account classification rather than judging it by whether this particular request costs money. These terms do not establish the consumer Gemini app's policy. See our Gemini scope notes.

DeepSeek: do not infer an API exemption

DeepSeek's privacy policy describes collecting prompts and files, using personal data for technology improvement and training, and processing and storing personal data in China. It also describes an opt-out right for training uses. Our review did not establish an API-specific no-training guarantee or fixed API retention schedule.

The policy distinguishes downstream developers' applications, which need their own disclosures. Resolve those gaps for the actual route rather than borrowing another provider's API defaults. The DeepSeek record keeps these unknowns explicit.

Keep a short approval record

Before the real upload, save the policy links and review date with a short record of the account, workspace, material and purpose. Capture the relevant settings without exposing secrets. Note any required deletion action and who owns it. Recheck when changing plans, models, integrations or organizational accounts.

• Confirm you are permitted to share the source material.
• Verify training, retention and deletion as separate controls.
• Check whether files, search tools or feedback create additional copies.
• Send only the minimum material needed for this task.
• Keep unresolved requirements visible rather than labeling the service private.

Before relying on a policy

Official pages were reviewed on October 21, 2026. Check negotiated agreements, deletion controls, data residency, and security requirements for the specific account and feature. Missing information is an unresolved check, not proof that a protection is absent. Revisit the source documents before relying on them for a specific draft.