Ask your AI tools where the data goes.
A program coordinator at a nonprofit pastes a grant budget into a chat window and asks for a cleaner summary. The summary is good, and she moves on. Ask her a week later where that budget is now, who could read it, and whether it will ever be deleted, and she won't know. Neither will her director, because nobody in the organization has asked the tool.
Every AI tool your team uses has answers to those questions. They are written down somewhere, in a settings page, a privacy document or a contract, and most of them were decided by the vendor before anyone on your side signed in. Getting them takes an afternoon, which makes it some of the cheapest risk work an organization can do.
The answer usually sits in a setting nobody opened.
Many AI products come in more than one version: a free or personal account, a paid individual plan, and a team or organization plan with an admin console. The versions often handle data differently, and the differences live in defaults. A person who signs up with a work email on a personal plan may be using the version with the loosest terms while assuming they have the strictest.
So the first job is an inventory of which accounts people are actually using, and on which plan. The list usually runs longer than leadership expects: the tool the organization pays for, the free tools people found on their own, and the AI features that arrived inside software you already had, such as the email client, the document editor and the video calling app.
Training and retention are separate questions.
People tend to ask one question, "does it train on our data?", and stop when the answer is no. That answer matters. If a vendor uses your conversations to improve its models, fragments of what your staff typed can shape what the model produces for everyone else. Most vendors let you switch this off on at least some plans, and some switch it off by default for organization accounts. Check which applies to the plan each person is on.
Retention is a different matter. A tool that never trains on your data may still keep every conversation for a period of time, sometimes for safety review, sometimes for legal reasons, sometimes indefinitely until someone deletes it. A file that sits on a server for months is exposed to whatever happens to that server in the meantime.
Find out who can read the conversations.
There are usually more readers than people assume. Some vendors allow a small number of their own staff to review conversations flagged for abuse or safety. On organization plans, your own administrators may be able to see or export what employees typed. Workspaces and shared projects can make one person's chat visible to a whole department, and a shared link can make it visible to anyone who has the link.
Connections to other systems add a second layer. When an AI tool is linked to your drive, inbox or calendar, it can often read whatever the signed-in person can read. That is the point of the connection, and it is also how a question about one client's file pulls in another client's file from the same folder. Ask what each connection can reach, whether access can be narrowed, and who in your organization is allowed to turn connections on.
A default someone else chose on your behalf is still a decision about your data, and you are the one who answers for it.
Deletion has more than one meaning.
Deleting a chat from the sidebar is not always the same as deleting it from the vendor's systems. Ask what happens on their side when a user deletes a conversation, how long until it is gone from backups.
The case that catches organizations most often is the departing employee. When someone leaves a clinic or a school district, their email is closed and their laptop comes back. Their AI account, especially one on a personal plan, may keep months of conversations about patients, students or contracts, and nobody has the login. An organization plan with central accounts is often worth it for this reason alone, because it lets you close an account and its history the same day.
Get the answers in writing.
A sales call will usually produce reassuring answers. Those answers should match something you can point to later: the vendor's privacy or data-use page, the terms for your specific plan, the admin console settings, and for larger contracts a data processing agreement. If a representative says a thing that you can't find written down, ask them to send it in writing. If they can't, plan as though the answer is no.
Keep what you find in one place, next to the list of approved tools, with a date on it. Vendors change their terms, and a short annual review, done by whoever owns AI in your organization, catches most of those changes before they matter.
The vendor question sheet.
Put these to every AI tool your team uses. Write the answer and where you found it next to each one.
- Which plan is each person on, and are any work tasks running through personal accounts?
- Does the vendor use our conversations, files or outputs to train or improve its models, and is that on or off for our plan by default?
- How long are conversations, uploads and outputs kept, and can we shorten that?
- Does a temporary or private chat mode change what is kept, and for how long?
- Who at the vendor can read our conversations, and under what circumstances?
- Who inside our organization can see or export what employees type?
- What can shared links, workspaces and projects expose, and to whom?
- Which of our systems is the tool connected to, what can each connection read or change, and who can add new ones?
- When a user deletes a conversation, what is removed, from where, and how long does it take?
- What happens to an account and its history when someone leaves, and who can close it?
- Where are these answers written down, and on what date did we last check them?
