Skip to main content

Data Privacy & Security When Using AI

Your data privacy and security should be top priorities when using AI tools. This lesson covers what you need to know to protect yourself and your information.

What Data Do AI Companies Collect?​

Input Data​

What you share:

  • Text you type in conversations
  • Images you upload for analysis
  • Files you share for processing
  • Voice recordings (for speech AI)
  • Personal information you mention

How it's used:

  • To generate responses to your queries
  • To improve the AI model (sometimes)
  • For safety and abuse monitoring
  • For service analytics and debugging

Usage Data​

What's tracked:

  • When you use the service
  • How long your sessions last
  • Which features you use most
  • Your general location (country/region)
  • Device and browser information

Account Data​

What's stored:

  • Email address and username
  • Billing information (for paid services)
  • Conversation history
  • Preferences and settings
  • Subscription status

Understanding Privacy Policies​

Key Questions to Ask​

  1. Data Retention: How long is my data kept?
  2. Data Usage: Is my data used to train the AI?
  3. Data Sharing: Is my data shared with third parties?
  4. Data Location: Where is my data stored geographically?
  5. Data Control: Can I delete my data?

Major AI Services - Privacy Summary​

OpenAI (ChatGPT)​

  • Data Training: Can opt out of data training
  • Retention: Conversations kept for 30 days, then deleted unless saved
  • Control: Can delete conversations and account
  • Location: Data stored in US
  • Business vs Personal: Different policies for enterprise users

Anthropic (Claude)​

  • Data Training: Does not use conversations for training by default
  • Retention: Conversations kept for 90 days for safety monitoring
  • Control: Can delete conversations
  • Location: Data stored in US
  • Privacy Focus: Strong emphasis on user privacy

Google (Gemini)​

  • Data Training: May use data to improve services
  • Retention: Tied to Google account settings
  • Control: Google account controls apply
  • Location: Global Google infrastructure
  • Integration: Connected to broader Google ecosystem

Microsoft (Copilot)​

  • Data Training: Policies vary by service (365 vs consumer)
  • Retention: Different for enterprise vs consumer
  • Control: Varies by account type
  • Location: Global Microsoft infrastructure
  • Business Focus: Strong enterprise privacy protections

Protecting Sensitive Information​

What NOT to Share with AI​

Personal Identifiers

  • Social Security numbers
  • Passport or driver's license numbers
  • Credit card information
  • Banking details
  • Home addresses
  • Phone numbers

Confidential Business Information

  • Trade secrets
  • Proprietary data
  • Customer lists
  • Financial records
  • Employee information
  • Strategic plans

Private Personal Information

  • Medical records
  • Legal documents
  • Private correspondence
  • Family photos (unless necessary)
  • Login credentials
  • Personal relationships details

Professional Confidentiality

  • Client information (lawyers, doctors, therapists)
  • Student records (teachers)
  • Patient data (healthcare workers)
  • Classified information (government/military)

Safe Alternatives and Practices​

Anonymization Techniques​

Instead of: "My client John Smith from ABC Corp needs help with his contract" Use: "A client needs help understanding contract terms for a software licensing agreement"

Instead of: "I work at [Company Name] and our revenue last quarter was $X" Use: "A mid-size tech company with quarterly revenue around $X needs help with analysis"

Data Sanitization​

  • Remove names, addresses, and phone numbers
  • Replace specific companies with "Company A" or industry type
  • Use placeholder dates instead of specific ones
  • Remove financial specifics when possible

Work-Safe Practices​

  • Use generic examples instead of real cases
  • Focus on concepts rather than specific implementations
  • Create hypothetical scenarios based on real situations
  • Avoid copy-pasting sensitive documents

Enterprise vs Personal Use Considerations​

Personal Use​

Risks:

  • Data may be used for model training
  • Less control over data retention
  • Minimal legal protections
  • Shared infrastructure

Best Practices:

  • Read and understand privacy policies
  • Regularly review and delete conversation history
  • Use incognito/private browsing when possible
  • Avoid sharing sensitive personal information

Business/Enterprise Use​

Additional Protections:

  • Business Associate Agreements (BAAs)
  • Data Processing Agreements (DPAs)
  • Dedicated instances or isolated environments
  • Enhanced security controls
  • Compliance certifications (SOC 2, ISO 27001)

Enterprise Features:

  • Admin controls over data usage
  • Audit logs and compliance reporting
  • Integration with existing security tools
  • Custom retention policies
  • Regional data residency options

Data Retention and Deletion Policies​

Understanding Retention Periods​

Immediate Deletion

  • Some services allow immediate conversation deletion
  • May still retain data for short periods for safety/abuse monitoring

Standard Retention

  • 30-90 days is common for conversation data
  • Account data may be retained longer
  • Billing data kept for legal/tax requirements

Long-term Retention

  • Some aggregated/anonymized data may be kept indefinitely
  • Model training data typically kept permanently
  • Legal compliance may require certain data retention

How to Delete Your Data​

ChatGPT​

  1. Go to Settings & Beta → Data Controls
  2. Turn off "Chat history & training"
  3. Delete specific conversations or clear all history
  4. Request account deletion through support

Claude​

  1. Delete individual conversations from the interface
  2. Contact support for full data deletion
  3. Account deletion removes associated data

General Steps for Any Service​

  1. Check settings/privacy controls
  2. Delete conversation history
  3. Turn off data training if option available
  4. Request account deletion if needed
  5. Follow up to confirm deletion

International Considerations​

GDPR (European Union)​

Your Rights:

  • Right to know what data is collected
  • Right to access your data
  • Right to correct inaccurate data
  • Right to delete your data
  • Right to data portability
  • Right to object to processing

CCPA (California)​

Your Rights:

  • Right to know about data collection
  • Right to delete personal information
  • Right to opt-out of data sale
  • Right to non-discrimination

Other Regulations​

  • Canada (PIPEDA): Privacy protection in commercial activities
  • UK (UK GDPR): Similar to EU GDPR
  • Brazil (LGPD): Data protection law
  • Australia (Privacy Act): Personal information protection

Practical Security Tips​

Browser and Device Security​

  • Keep browsers and devices updated
  • Use strong, unique passwords
  • Enable two-factor authentication when available
  • Use private/incognito browsing for sensitive sessions
  • Clear browsing data regularly

Network Security​

  • Avoid using AI tools on public Wi-Fi for sensitive tasks
  • Use VPN when possible for additional privacy
  • Be cautious with shared or work computers

Account Management​

  • Regularly review account settings and privacy controls
  • Monitor for unusual activity
  • Use separate accounts for different purposes when beneficial
  • Keep contact information updated for security notifications

Red Flags and Warning Signs​

Service Red Flags​

  • No clear privacy policy
  • Vague data usage terms
  • No data deletion options
  • Requests for unnecessary personal information
  • No security certifications or compliance mentions

Usage Red Flags​

  • Pressure to share sensitive information
  • Requests for login credentials
  • AI asking for personal details unprompted
  • Services with no customer support
  • Unusually low prices for premium features

What's Next?​

Understanding data privacy is just one aspect of responsible AI use. Next, let's explore the broader ethical considerations when using AI tools.

Key Takeaways​

  • AI companies collect input data, usage data, and account information
  • Read privacy policies and understand data retention periods
  • Never share sensitive personal, financial, or confidential business information
  • Use anonymization and sanitization techniques for work-related queries
  • Enterprise users typically have better privacy protections than personal users
  • You have rights regarding your data, especially under GDPR and CCPA
  • Regularly review and delete your conversation history
  • Use strong security practices for your accounts and devices