The first thing most people type into an AI tool is something they shouldn’t. A CV with a home address still on it. A spreadsheet of customer emails copied out of a CRM. A contract a client assumed would stay confidential. The tool answers cheerfully, nobody thinks about it again, and that text is now sitting on a server in another country.
This isn’t a scare piece and it isn’t a feature comparison. It’s the short version of a privacy review a beginner can genuinely run: the three questions worth asking before you sign up, the settings worth changing on day one, and the places where new users quietly lose control of what they’ve pasted.
What a privacy review is really asking
Strip the legal language off a privacy policy and three questions survive:
- Is my input stored? Some tools keep every conversation until you delete your account. Others wipe chats after a set window, or run a “temporary” mode that leaves no trace.
- Is it used to train a model? This is the big one. Training on your inputs means your text may surface, in fragments, in someone else’s answer months later.
- Can a human read it? Most providers sample conversations for safety review or quality checks. The question is whether those samples are random, only triggered by flagged content, or opt-in.
Two companies can both claim to “take privacy seriously” and answer those three questions in completely opposite ways. Policies on review samples range from a few weeks to several years, depending on the provider. That’s the whole reason a five-minute check beats a badge on a homepage.
The settings that do most of the work
Menus get renamed every few months, so don’t memorise clicks. Learn what you’re hunting for.
Training on your chats
ChatGPT has carried a toggle along the lines of “Improve the model for everyone,” tucked under Settings, then Data Controls. Switching it off doesn’t delete anything you’ve already sent, it just stops new conversations feeding the model. It’s a two-second job that most people never do.
Retention and history
Deleting a chat is not always the same as deleting the record. Look for an account-level delete or export option rather than removing conversations one at a time. Several providers hold deleted data for around 30 days before it’s actually gone. “Temporary chat” or “incognito” modes are worth knowing about for one-off questions you’d rather not have in a sidebar.
Connected apps and file access
The quiet risk sits in integrations. A tool that can read your Google Drive or calendar is useful right up until you realise it has access to everything, not the one folder you meant. Grant folder-level access where the option exists, and go through connected apps every few months. Old experiments pile up fast.
The ten-minute pass, in order
- Turn off model training, then check it stayed off after your next login.
- Set history to off or auto-delete if the tool offers it.
- Remove any connected app you don’t recognise by name.
- Check which email the account uses. A work address is usually governed by an employer’s agreement, a personal one by consumer terms, and they are not the same document.
- Look at the billing page. Free tiers and paid plans often have different training defaults.
- Write down which tool holds what, in one line, somewhere you’ll find it again.
If you want a tighter version of this, there’s a structured ten-minute security review for AI tools that walks through settings, permissions and account hygiene in a single sitting.
Read the data controls page, not the marketing page
You don’t need to read a 40-page policy. Two pages earn their keep: the “how we use your information” section of the privacy policy, and the help-centre article on data controls, which is usually written in plainer English and gets updated when settings move. Search the site for “data controls,” “privacy settings” or “model training” and you’ll land in the right place faster than clicking through the product menus.
How the big names look to a first-timer
ChatGPT
The most documented, which makes it the easiest to audit. Free accounts have historically trained on inputs by default, so the toggle matters. Temporary chat is available and doesn’t appear in your history.
Microsoft Copilot
Copilot sits inside Word, Outlook and Teams, which is convenient and slightly awkward. On a work account your organisation’s Microsoft 365 agreement governs the data rather than the consumer terms. That’s a meaningful difference, and worth confirming with whoever runs IT. There’s a clearer breakdown of how Copilot Chat works and what it actually costs if you’re deciding whether it’s the right first tool.
Google Gemini
Wired into an account that probably already holds your email, photos and search history. Activity controls let you set auto-delete to 3, 18 or 36 months, and the reviewing process is worth reading properly rather than skimming. If you live inside Google already, treat this as the highest-stakes account on the list.
Claude and the smaller players
Less familiar branding, often clearer policies. Smaller providers tend to publish plain-language data pages and are more likely to offer a no-training default on paid plans. Don’t assume unknown means unsafe, and don’t assume famous means careful.
Where beginners actually leak data
Free tiers
Free plans are usually paid for with data. If you’re testing tools for anything work-adjacent, check whether the upgrade changes the training default before you paste anything real. A short guide to which AI tools are worth paying for covers where the paid tier genuinely buys you better terms rather than just a higher message limit.
API keys and half-built projects
The moment you build something yourself, the key in your code becomes a password to your billing account. If you’re following a tutorial to build your first AI chatbot in an afternoon, keep the key out of shared files and rotate it the second a project gets abandoned.
Browser extensions
An extension that “adds AI to every page” can read every page. That includes your bank, your inbox and your HR portal. Check the permissions before installing, and remove extensions you stopped using months ago.
One tool, one job, fewer accounts
Every extra account is another policy, another settings page and another place your text lives. The beginners who stay safest tend to be the boring ones: a single tool for a single job, learned properly, with the data controls configured once and checked occasionally. If you’re tempted to sign up for six apps this week, the argument for starting with one job instead of twenty apps is worth ten minutes of your attention before you hand over another email address.
Red flags that should make you close the tab
Some warning signs are consistent enough to act on immediately. No named company or registered address anywhere on the site. A privacy policy that amounts to a single vague paragraph, or a broken link to one. A request to “read, compose and send email” from your Google account when the tool’s only job is summarising documents. No way to delete your account from inside the product, only an email address that nobody answers.
And the simplest test of all: if you can’t answer the three questions, stored, trained on, human-reviewed, within about two minutes of opening the tool, don’t paste anything sensitive into it. Use it for a shopping list. Keep the client work, the medical question, the salary negotiation and the legal draft somewhere you can actually explain to another person.