Company data in ChatGPT: four questions to settle first

Does ChatGPT use my data for training? What OpenAI says

The short answer to “does ChatGPT keep what I type?” is yes: it saves conversations to your account until you delete them. The longer answer depends on the kind of account. This is what OpenAI's own pages say:

• Conversations are saved. Regular chats stay in the account until you delete them or a workspace retention policy removes them. When you delete one, it disappears from your view right away. OpenAI then schedules it for permanent deletion within 30 days, unless it has to keep it longer for security or legal reasons (OpenAI help: chat and file retention).
• On personal accounts they're used to improve the model unless you turn that off. On Free, Plus and Pro, data sharing is on by default. You switch it off in Settings, under Data controls, with the option called “Improve the model for everyone,” and you keep your chat history (OpenAI help: data controls).
• A thumbs up or thumbs down counts too. Per that same page, if you rate a response, the entire conversation tied to that feedback may be used for training even after you've opted out.
• Temporary chats don't appear in your history and aren't used to improve the models, but OpenAI may keep a copy for up to 30 days for safety purposes.
• On company workspaces, not by default. OpenAI says that by default it doesn't train its models on content from ChatGPT Business, Enterprise or Edu workspaces. It also says it can sign a Data Processing Addendum with Business, Enterprise and API customers (OpenAI enterprise privacy).

Put together: you can't answer “does ChatGPT use my data?” without first knowing which account each person on your team signs in with.

Four real risks

At Compass & Crane Travel, an eight-person travel agency, nobody decided to use ChatGPT. One coworker started with it to tidy up an itinerary, and a month later six people were using it, each on their own account. These are the risks, from most to least frequent:

1. Other people's personal data

Pasting a group list with names, dates of birth and passport numbers so it can “make it look nice.” That data belongs to the travelers, and they gave it to the agency, not to a chat tool. What the law requires in your state and industry is a question for your attorney; the practical precaution is not to paste it.

2. Client information

The contract with a hotel, a vendor's net rates, a company's incentive-trip plan. It isn't personal data, but it's someone else's, and it usually sits under a confidentiality clause or an NDA.

3. Made-up answers taken as good

Asking what visa a destination requires and forwarding the answer without checking it. These tools can invent a fact without blinking; it's called an AI hallucination. Here the risk isn't what goes in, it's what goes out under your name.

4. Nobody knows who's using what

With personal accounts, the company can't see what was shared, can't turn it off when someone leaves, and can't change everyone's settings at once. It's the risk that makes the other three possible.

Is ChatGPT safe for business use?

It depends on two things: what your company's policy says and what data goes in. We won't give you a yes or a no on the law. That depends on the plan, the settings, your industry and your contracts. You sort it out with OpenAI's documentation open and your attorney on the phone.

What is in your hands is having that policy. If there isn't one, every person has already written their own without telling you.

Four things to bring to that conversation with your attorney, as context and not as a ruling:

• Your contracts. Client agreements and NDAs often say where their information may go. Read the confidentiality clause before a tool does.
• Trade secrets. If part of your edge is something you keep secret, ask what pasting it into an outside tool does to that.
• Your industry's rules. If you handle patient information, HIPAA may apply. HHS says its rules apply to covered entities and their business associates, and that a covered entity needs a written contract with each business associate (HHS: covered entities and business associates). If you offer lending, financial advice or insurance, the FTC explains that the Gramm-Leach-Bliley Act requires financial institutions to explain their information-sharing practices and to safeguard sensitive data (FTC: Gramm-Leach-Bliley Act). Both checked on November 12, 2026.
• State privacy laws. They differ from state to state. Which ones reach a company your size is a question for your attorney, not for a guide.

On the health side, one more fact from OpenAI's enterprise privacy page: it says it can sign business associate agreements for its API, and it lists ChatGPT for Healthcare as a separate product. If patient information is involved, that conversation comes before any pasting.

Four rules for the team

1. One company account, not everyone's own. With someone who manages it and knows how it's set up.
2. Personal data and client information stay out. If the task needs them, take the names out first or find another way.
3. Anything going out to a client gets read by a person. Dates, amounts, requirements and proper names get checked at the source.
4. One person to ask. The questions will come anyway; better if they have somewhere to go.

A flat ban tends to end up where saying nothing does: people keep using it, only now in secret. If you want these rules as a one-page document, there's a fill-in starter in our guide to an AI policy for a small business.

What to ask any AI vendor

They work for ChatGPT, for Copilot, for us and for whoever comes next. Ask for the answers in writing:

• Where is the data? Which country, and whose servers.
• Is it used to train models? By default, and what you have to do to change that.
• Is there a data processing agreement? The document that governs what the vendor does with the personal data you hand over.
• How does deletion work? Who can request it, how long it takes and what stays in backups.
• Who sees what? Inside your company and inside the vendor.

ChatGPT and confidential information: when not to use it

• With health data, data about minors or ID documents. No office task justifies pasting them.
• To decide about a person: who gets hired, who gets credit.
• When you can't check the answer and a mistake has consequences.
• When your client has asked you by contract to keep their information inside your systems.

Checklist

1. You know who uses ChatGPT at your company and on which account.
2. Someone has looked at how the use of conversations is set up.
3. The four rules are written down and the team has read them.
4. There's one person to ask.
5. You've put the five questions to your vendor and have the answers in writing.