Free and paid AI tools: what happens to your data
The same chatbot handles your information completely differently depending on which plan you are signed in to. A side-by-side look at what each of the four big assistants actually does.
“Is ChatGPT safe to use?” is a question with no answer, and asking it that way is how services get into trouble.
The same product, under the same name, behaves completely differently depending on which plan the person is signed in to. A care worker on a free account and a care worker on a business account are using two different things with the same logo.
We read the four big assistants’ own published terms in September 2026. Here is what they say.
The comparison
| Free and personal plans | Business and enterprise plans | |
|---|---|---|
| ChatGPT | Training is on with an opt-out available. No SOC 2, no ISO certification, no UK data residency, no data processing agreement on any individual plan | Not trained on by default. DPA available. SOC 2 Type 2, ISO 27001/27017/27018/27701. Data residency in ten regions including the UK, on Enterprise |
| Claude | You choose at sign-up. If you allow it, chats may be kept de-identified for up to five years. If you decline, 30 days | Not trained on by default. DPA built into the commercial terms. SOC 2 Type 2, ISO 27001, ISO 42001, CSA STAR, NIST 800-171 |
| Google Gemini | Used to develop and improve Google’s products. A subset is read by human reviewers, and those are kept up to three years | Not human reviewed, and not used to train models outside your domain, without permission. Covered by the Cloud Data Processing Addendum |
| Microsoft Copilot | No consumer tier of this product | Prompts, responses and data reached through Microsoft Graph are not used to train the models. Inherits your existing Microsoft 365 contract |
Three things fall out of that table.
1. Every consumer plan we checked can use what you type
Not one of the three consumer assistants promises to leave your text alone by default.
ChatGPT lists “Content is used to train our models” against Free, Go, Plus and Pro, with the note “Opt-out available”. An opt-out is off until someone turns it on. Nobody turns it on.
Claude asks you to choose at sign-up. If you allow it, Anthropic may keep your chats in a de-identified form for up to five years. If you decline, retention drops to 30 days. Which means the answer for your organisation depends on what each member of staff clicked, months ago, without reading it.
Google Gemini is the most far-reaching. Google says conversations are used “to provide, develop, and improve Google products, services, and machine-learning technologies”, and that “a subset of chats are reviewed by human reviewers (including Google’s trained service providers)”. Those reviewed conversations are kept for up to three years, and deleting the chat does not remove them. Turning off “Keep Activity” stops future chats being used, but Google still holds them for 72 hours.
Read that last one again with a care worker in mind. If someone pastes a paragraph about a person you support into personal Gemini, the realistic worst case is not an abstraction about model training. It is that a stranger at a contractor reads it, and a copy exists for three years.
2. “We do not train on your data” is not the same as “nobody reads it”
This is the distinction that catches people out, because the marketing line and the actual commitment are different sentences.
Microsoft is the clearest. It says prompts, responses and Graph data “aren’t used to train foundation LLMs”, and that while human abuse-monitoring review is available in Azure OpenAI, “Microsoft Copilot services have opted out of it”. Both halves.
OpenAI’s business terms say the opposite on the second half. Business data is not used for training, but OpenAI says access includes “specialized third-party contractors who are bound by confidentiality and security obligations, solely to review for abuse and misuse”.
Anthropic has a narrower carve-out: commercial plans are not used for training, except that thumbs up and thumbs down feedback may be, until an owner turns off the “Rate chats” setting. A well-meaning member of staff rating a response can put that exchange into a different bucket.
So there are two questions, not one. Is it used to train the model? And can a human being read it? A supplier can honestly answer no to the first and yes to the second.
3. The compliance paperwork starts at the business tier
This is the part that decides whether a plan is lawful for care data, and it is remarkably consistent.
On ChatGPT’s own comparison table, SOC 2 Type 2, the ISO certifications and UK data residency are all marked “No” for Free, Go, Plus and Pro. Not “limited”. No.
Anthropic’s Trust Center is blunter still: its certification matrix lists Claude Team, Claude Enterprise and the API. Free, Pro and Max do not appear in it at all.
And a data processing agreement — the document that makes your organisation the controller and the supplier the processor — is business-tier only in every case. OpenAI offers one for Business, Enterprise and the API. Anthropic builds one into the commercial terms for API, Console, Team and Enterprise. Neither offers one to a personal account.
Without a DPA you have no contract governing what the supplier does with personal data. That is not a technicality. It is the thing your DPIA will ask you about, and the thing you cannot answer by upgrading to Plus.
The UK wrinkle
Two of the four have a specific UK problem worth knowing.
Microsoft commits to the EU Data Boundary, and the UK is not in it. Microsoft’s own wording: “Customers outside the EU may have their queries processed in the US, EU, or other regions.” A UK care provider needs Advanced Data Residency to narrow that, and should expect commissioners to ask.
Anthropic publishes no UK data residency option at all, and does not state a hosting region on its Trust Center landing page. It does list UK Cyber Essentials among its certifications, which is worth something in a DSPT conversation, but that is not the same as knowing where the data sits.
OpenAI offers UK data residency, but only on Enterprise — not on Business, and certainly not on Plus.
What this means on Monday
The practical problem in most small services is not that someone chose the wrong plan. It is that nobody knows which plan anyone is on.
Most care workers who use AI already have a personal account. Many will also have a work login. The two look almost identical on screen and behave completely differently. Somebody can be signed into the wrong one for months.
So:
- Write down which tools and which plans are approved. Not “ChatGPT is fine” — “ChatGPT Business, signed in with your work email”. Our one-page AI use policy has a place for this.
- Assume every personal account is public. Nothing about a person you support goes into one, ever. That is rule one of the golden rules for exactly this reason.
- Check the training setting on any account already in use, rather than assuming a paid plan turned it off. On Claude it is a choice someone made at sign-up; on ChatGPT Plus it is an opt-out that is off by default.
- Ask for the DPA in writing before anything touches real data, and keep it with your DPIA.
- Re-check annually. Every fact on this page came from a supplier page that the supplier can change without telling you. Our tool directory dates every entry for the same reason.
Google is two different products with one name
This is worth pulling out, because it is the sharpest example of the point this whole page is making.
Consumer Gemini and Gemini in Google Workspace share a name, an interface and almost nothing else.
On Workspace, Google commits that “your content is not human reviewed or otherwise used for Generative AI model training outside your domain without permission”, your content “is not used for any other customers”, and the Cloud Data Processing Addendum applies. It carries ISO 27001, ISO 42001 and SOC 1, 2 and 3.
On a personal account, a subset of chats is read by human reviewers and kept for up to three years.
Same logo. If your organisation runs on Workspace, the protections are real — but only on the work account, and staff very often have both.
Two Workspace details worth knowing:
- Processing can be pinned to the US or the EU. There is no UK-only option. The same gap Microsoft has.
- Gemini Notebook is carved out. Google states that your organisation’s file sharing and data region settings do not apply to data inside it. If you have pinned your region, that setting does not follow your data into Notebook.
Retention on Workspace is whatever your admin set, and the range runs to indefinite. Check it rather than assuming a short window.