ChatGPT safety profile

What it does with your data

What happens to your data depends on which plan staff are signed in to. On the plans for individuals (Free, Plus and Pro), OpenAI says it may use what you type, paste or upload to train its models. Data sharing is turned on by default in those personal workspaces. On ChatGPT Business, Enterprise and Edu, OpenAI says it does not use prompts, responses or files for training unless the organization signs a separate agreement.

The individual plans have one catch. If someone gives feedback, such as a thumbs up or down, the whole conversation may be used for training, even after they have opted out. On Business, Enterprise and Edu, feedback does not permit training.

Temporary chats are not used to improve models while they stay temporary, but they may be kept for up to 30 days for safety reasons. On consumer plans, chats you delete are removed within 30 days. The exceptions are data kept longer for legal, safety or security reasons and content already de-identified for training.

Settings to change first

If anyone at your organization uses a Free, Plus or Pro account for work, change these settings before they start:

1. On the web, open the account menu, then go to Settings > Data controls > Improve the model for everyone. Turn it off and select Done.
2. On iOS and Android, open the sidebar and select your profile icon to open Settings. Select Data controls, then turn off Improve the model for everyone.
3. If staff use voice mode, check its separate control for sharing training data.
4. If staff use Codex, check the Include environments setting in Codex settings. The main ChatGPT setting does not change it.

Opting out applies to new conversations only. Ask staff not to rate work chats with a thumbs up or down, since feedback can still allow training.

On Business, Enterprise and Edu, admins can turn feedback on or off under Workspace settings > Allow response feedback in the Admin Console.

Free and paid tiers

The biggest difference between tiers is training. OpenAI may use Free, Plus and Pro content for training by default. It does not use Business, Enterprise, Edu or API data that way by default, and the business privacy pages say training happens only if the customer explicitly opts in.

Other differences the vendor pages describe:

• After opting out, feedback still allows training on that conversation on Free, Plus and Pro, but not on Business, Enterprise or Edu.
• OpenAI collects ads history and interests from Free and Go users and uses them to personalize ads, subject to their settings.
• The consumer privacy policy does not cover content processed for business customers. Customer agreements govern that content instead.
• Free, Go, Plus and Pro users can export their data and delete their account themselves. In managed workspaces, those requests go through the workspace owner.

Admin controls

Admin controls come with the business plans.

• Business (and Teachers): multi-factor authentication, roles (Member, Admin, Owner), GPT controls, SAML single sign-on and basic analytics. Business admins can also view, export and delete members’ conversations and control retention.
• Enterprise, Edu and Healthcare: everything in Business, plus SCIM, role-based access controls, centralized spend controls, user analytics, Microsoft Intune support and an audit log through the Enterprise Compliance API.

OpenAI also offers Enterprise Key Management for customers who want to control their own encryption keys. The pages checked do not say which plan includes it.

On audits, OpenAI says Business, Enterprise, Edu and Healthcare each completed a SOC 2 Type 2 audit. The pages name no certification for Teachers.

Using it with donor and client data

Use a ChatGPT Business or Enterprise workspace for any work that touches donors or clients. On those plans, prompts and files stay out of training by default, and you get admin control over retention and access. Business admins can view members’ conversations, so tell staff that work chats are not private from the organization.

Whatever plan you use, set a clear rule about what never goes in:

• donor names alongside gift amounts or giving history
• client case notes
• health or payment details

If your organization needs data stored in a particular region, confirm eligibility in writing with OpenAI first. The pages checked say only eligible Enterprise, Edu, Healthcare and API customers can choose where content is stored. Consumer data may be stored in the United States and other places. Also ask in writing which plan includes Enterprise Key Management, since the pages do not say.

Questions people ask

Does ChatGPT use our chats to train its models?

On Free, Plus and Pro, it may, unless you turn off Improve the model for everyone. On Business, Enterprise and Edu, OpenAI says it does not train on prompts, responses or files by default.

If we delete a chat, is it gone?

On consumer plans, OpenAI removes deleted chats within 30 days. It can keep data longer for legal, safety or security reasons. On business plans, workspace admins control retention, and deleted conversations are removed within 30 days unless the law requires longer.

Can we choose where our data is stored?

Only some customers can. Eligible Enterprise, Edu, Healthcare and API customers can store content at rest in regions including the U.S., Europe, UK and Canada. Consumer data may be stored in the United States and other places.