Before entering financial, personal, regulated, or proprietary information into an AI service, identify the exact product and account you will use, then check the contract and data rules that apply to it. A provider’s privacy or security page may describe its practices, but it is not necessarily the binding agreement—and terms for one plan or feature may not cover another.
Start with the exact service and governing documents
Write down the product name, tier, account type (consumer, team, enterprise, or API), route of access, and region if relevant. Then collect the documents that govern that use: terms of service, privacy notice, product-specific terms, data processing addendum (DPA), security addendum, order form, and any negotiated terms. Check which document prevails if they conflict.
As an Amazon Associate I earn from qualifying purchases.
Providers may publish separate documents for different products and customer types. OpenAI’s legal index, for example, lists distinct individual terms, service terms, DPA, business terms, enterprise privacy, privacy policy, and data-use materials. Do not treat a general privacy statement as a substitute for the terms attached to your account.
The Tool Desk
Outbyte Driver Updater FREEScan for outdated or missing drivers - takes under a minuteDriver Scan →Outbyte PC Repair FREERepair Windows errors before they cause bigger problemsFix Now →What happens to prompts, files, and outputs?
For each category of information you might submit, check whether it can be used to deliver the service, train or improve models, detect abuse, support product analytics, undergo human review, or meet legal requirements. Look for the rule’s status: is it the default, an opt-out, an opt-in, a setting you must enable, or a negotiated contract term? Check the setting in the account you actually use.
Provider statements are specific to their stated products and should not be read as universal rules. OpenAI says that, by default, it does not use inputs or outputs from ChatGPT Enterprise, ChatGPT Business, ChatGPT Edu, ChatGPT for Healthcare, ChatGPT for Teachers, or its API platform to train or improve its models; see its business data privacy page. OpenAI also describes encryption and other security measures there, including AES-256 at rest and TLS 1.2 or higher in transit. These are the company’s published claims, not an independent assessment.
Anthropic says commercial customers can opt out of model training through account settings and describes customer-content rights and confidentiality in its transparency materials. Microsoft says specified prompts, responses, and Microsoft Graph data in organizational Copilot are not used to train foundation models; its guidance also distinguishes web queries sent to Bing. These are separate provider descriptions, not a like-for-like comparison under identical contracts.
How long are chats and other data retained?
Check retention separately for saved chat history, backend copies after deletion, abuse-monitoring logs, application state, uploaded files, backups, and legal or policy exceptions. Also ask whether a control is available to your account and covers every feature you plan to use.
Free tools Windows power users keep installed
One-click scans. No signup required.
Rank #2
- Used Book in Good Condition
Anthropic’s Privacy Center guidance says API inputs and outputs are deleted from its backend within 30 days, subject to stated exceptions such as a service with longer retention, a different agreement, policy enforcement, or legal requirements. For commercial products that save conversations, it says chats remain in product history to support continuity; after a user deletes a chat, it is removed from history immediately and backend systems within 30 days. These are Anthropic-specific published timeframes, not an industry standard.
OpenAI says Zero Data Retention controls require approval, and its API data documentation warns that some endpoints or capabilities may retain application state even when the control is enabled. Confirm the particular endpoint and feature rather than relying on the control’s name alone.
Does the DPA cover this product and feature?
Read the DPA alongside the main service agreement. Check its scope and the provider’s role; the processing instructions; confidentiality and security obligations; subprocessors and international transfers; breach notification; help with data-rights requests; deletion or return; audit evidence; and exceptions or limits. Confirm that the DPA is incorporated into the agreement for the product and features you will use.
OpenAI’s DPA says it applies to customer data submitted through the API or specified business services under the applicable business terms, enterprise agreement, or other governing agreement. It also says certain compliance materials are provided on reasonable request, no more than annually. Microsoft says organizational use of Copilot and Copilot Chat is covered by the Microsoft Products and Services DPA and Product Terms, with Microsoft acting as processor; see its Microsoft Learn privacy documentation. These statements describe the named services and organizational use, not every product from either company.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
Check what the security assurance actually covers
Do not stop at a certification name or security badge. Find out which service, environment, and controls were assessed, whether an independent report is available, and what settings or safeguards remain your responsibility. OpenAI describes certifications and audit information for specified services on its business data privacy page. Microsoft describes enterprise protections including encryption and tenant isolation, as well as application of organizational identity, permissions, sensitivity labels, retention settings, and audit controls; details vary by subscription in its Copilot privacy documentation.
Find the service-level promises and remedies
Privacy and security terms do not tell you whether the service has an uptime target, support-response commitment, maintenance rules, incident-notice deadline, service credits, liability cap, suspension right, or data-export and transition support. Find the service-level terms and order form for the exact plan. Check how an outage is defined, how to claim any remedy, and what happens to access and data when the service ends.
Rank #4
- Used Book in Good Condition
Official document indexes and agreements establish where to look, but the sources cited here do not establish one comparable availability or support promise across providers. Do not assume an uptime percentage or response time unless it appears in the contract that governs your account.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.Trace connectors, agents, and searches
Make a list of every connector, retrieval source, agent, browsing or search function, plug-in, API endpoint, and subprocessor involved. For each, ask what information leaves the core service, which party controls that processing, and whether the same retention, residency, training, and compliance commitments still apply.
Do these 3 things before closing this tab:
1Fix the driver behind crashes, sound loss and screen glitches2Clear out junk files and repair common Windows errors3Scan for outdated or missing drivers - takes under a minuteMicrosoft says Copilot web queries are sent to Bing under separate data-handling practices and terms, and advises users to check an agent’s own privacy statement and terms; see its Copilot privacy documentation. OpenAI’s endpoint-specific retention guidance is another reason to check each capability rather than assume a service-wide setting covers every path.
Use a like-for-like review before sharing sensitive information
When comparing plans or providers, record the same facts for each option instead of comparing broad marketing claims:
- Covered product, plan, account type, contract hierarchy, and region.
- Permitted uses of prompts, outputs, uploads, telemetry, and feedback.
- Training, human review, safety monitoring, and the defaults or controls that apply.
- Retention and deletion by data type, endpoint, and connected feature.
- DPA scope, processing roles, subprocessors, locations, and legal assistance.
- Security controls and independent assurance for the service being purchased.
- Availability, support, incident notice, remedies, liability, suspension, and exit terms.
- Separate handling for search, browsing, connectors, agents, and external integrations.
For a personal-finance use case, a useful final check is whether the specific data you plan to enter is necessary at all. If a task can be completed with figures stripped of names, account numbers, addresses, and other identifying details, reducing what you share can limit exposure regardless of the provider’s terms. Whether a service is suitable for particular financial or regulated information depends on the data, jurisdiction, configuration, contract, and your obligations; this checklist is not a legal determination. Recheck current terms and product documentation before procurement or a material change in use.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
