What actually happens to your data when we build an AI workflow.

The one question that matters most: does it train on your data?

When you type something into an AI tool, one of two things can happen to it: it can be used to improve that company's future models (meaning fragments of it could theoretically influence future outputs for other users), or it can be excluded from training entirely and used only to generate your response. Which one applies depends on the tool and the plan:

• Free consumer tiers (a personal ChatGPT, Claude, or Gemini account with no paid plan) often train on conversation content by default, though most now offer an opt-out toggle in settings.
• Paid individual plans (ChatGPT Plus, Claude Pro) typically do not train on your conversations by default as of this writing — but "typically" isn't good enough for customer data, so this gets verified against the current policy before any workflow goes live, not assumed.
• Business/Team/Enterprise tiers and API access generally come with contractual guarantees that your data is not used for training, plus admin controls and data-retention settings. This is the default recommendation for any workflow that touches real customer information.

How this gets handled in a project

1. Before anything is built, the specific tool and tier being used is named in writing, along with its current data-training and retention policy.
2. Customer-identifying information is minimized wherever the workflow allows it — for example, a review-reply workflow needs the review text, not the customer's full account history.
3. Anything sensitive gets flagged before it's built, not after. Health information, financial account numbers, donor/member records, anything under an NDA — these need a specific answer, not an assumption, before they go anywhere near an AI tool. See what AI can't do yet for where this practice draws the line.
4. You get the settings, not just the workflow. Data-retention and training-opt-out settings are part of what's documented and handed off — you can verify them yourself at any time, in your own account.

A simple way to think about what's safe to paste

Generally fine in a standard business-tier AI tool: a review someone already posted publicly, a job description you wrote, general business copy, aggregated numbers with no names attached.

Worth a second look first: a specific customer's full name plus contact info plus purchase history together, anything with a dollar amount tied to a specific person, employee performance details.

Don't paste into a general AI tool without a specific, verified data agreement in place: health information of any kind, full financial account numbers, Social Security numbers, anything covered by a signed confidentiality agreement.