The short answer
Business plans and developer APIs from the major providers do not train on your prompts, files or outputs by default. Personal and free accounts may, unless the user opts out: the most common way business information leaks. Prompts may still be kept for a period, processed abroad or held when the law requires it. Data that must stay in your environment needs a private model on servers you control.
Business and consumer plans are not the same
| Provider | Business plans and APIs | Personal accounts |
|---|---|---|
| OpenAI | ChatGPT Business, Enterprise, Edu and the API: not used for training by default | Individual plans may train unless the user turns off "Improve the model for everyone"; rating a response can allow training on that chat |
| Anthropic | Claude for Work, Claude Gov and the API: not used for training by default | Free, Pro and Max users choose; chats kept five years if they allow training, 30 days if not |
| Gemini in Workspace and Google Cloud's Gemini Enterprise Agent Platform (formerly Vertex AI): no training without permission | The free Gemini API tier improves Google products and human reviewers may read it; Google warns against confidential data | |
| Microsoft | Microsoft 365 Copilot and Azure's AI services: prompts and data not used to train foundation models | Consumer terms; check settings |
| Amazon | Amazon Bedrock: not used to train models, not shared with third-party model providers | Not applicable |
Summaries of published terms, October 2026. Terms change often (several did in 2025 and 2026) and depend on plan, model and settings: check the referenced documents before relying on them. Microsoft 365 Copilot is now Microsoft Copilot.
Retention: how long your prompts are kept
Not training on your data is not the same as not keeping it.
| Practice | What is kept |
|---|---|
| Abuse monitoring | Many APIs keep prompts and outputs briefly to detect misuse, then delete them: up to 30 days (OpenAI and Anthropic APIs), 55 days (paid Gemini API) |
| Stored features | History, files and assistants: kept until you or your retention settings delete them |
| Workspace retention | Administrators usually set rules; logs may be kept for your own compliance |
| Legal holds | Every provider may keep data when the law requires. A 2025 copyright-case order made OpenAI preserve consumer ChatGPT and API data, deleted chats included, until September 2025; ChatGPT Enterprise, Edu and zero data retention API customers were excluded (OpenAI) |
What "zero data retention" means
With zero data retention, prompts and outputs are processed and returned but not written to storage afterwards, even for abuse monitoring. Several providers offer it; how you get it differs.
How each provider offers it
| Provider | How to get it |
|---|---|
| OpenAI and Anthropic | Eligible API customers, subject to approval, usually through sales |
| Microsoft | Modified abuse monitoring for Foundry models, by application, for customers managed by a Microsoft account team or in an eligible programme |
| Use the Gemini Enterprise Agent Platform (formerly Vertex AI), not the Gemini Developer API; turn off or avoid features such as caching and grounding with Google Search | |
| Amazon Bedrock | A zero data retention mode set per region, for most models |
Where your data is processed
Storage location is not processing location, and for Nigerian organisations neither is usually in Nigeria.
- No major AI service processes in Nigeria: OpenAI's in-region processing covers only the US, Europe and the United Arab Emirates; Microsoft 365 offers no Nigerian data residency; the nearest Azure and Google Cloud regions are in South Africa.
- Personal data in prompts is a transfer abroad: it needs a lawful basis under the Nigeria Data Protection Act 2023 (NDPA) and usually a data protection impact assessment (DPIA) under the NDPC's GAID 2025.
- Cloud routing: "global" or cross-region routing can send prompts elsewhere for capacity or cost; pin regulated workloads to one region and record the transfer basis.
Rather talk it through? If you are not sure what your AI tools keep or where they process data, we can check the terms and settings for each one. Talk to a Promatics specialist
Three levels of control
| Level | How it works | Who processes your prompts |
|---|---|---|
| Business plan or API, standard terms | No training; prompts kept for a limited period | The provider |
| Zero data retention API, or models in your cloud account | No training; nothing stored after the response (limited exceptions), or processing under your cloud agreement in your chosen region | The provider or your cloud provider |
| Private, self-hosted model | An open-weight model on GPU servers you control, which can be in Nigeria | Only your organisation |
Only the third level can keep AI processing in Nigeria, on your premises or in a Nigerian data centre. When it is worth it: self-hosted models vs AI services.
Models in your own cloud account
AWS states that Amazon Bedrock prompts and outputs are not used to train models and are not shared with the third-party model providers (AWS). Microsoft states that prompts sent to the models it sells through Azure are not available to OpenAI or other model providers (Microsoft Learn).
Questions to ask about every AI tool
- Is this a business plan or a personal account?
- Is training on our prompts, files and outputs off by default?
- How long are prompts and outputs kept, and for what purpose?
- Is zero data retention available for our model? What does it exclude?
- Who at the provider can review our data, and when?
- Where is data stored and processed, and what is our lawful basis for sending it outside Nigeria?
- Which sub-processors and third-party model providers receive data?
- Can we export or delete our data, and how fast is deletion?
- Must any information stay entirely in our own environment, or in Nigeria?
When to bring in help
Checking one approved tool is manageable. Bring in help when staff use many AI tools (some on personal accounts), client or personal information is involved, or clients and regulators ask how AI is controlled. The NDPA, transfer rules included, applies to personal data in AI tools (AI and the NDPA). In October 2026 NITDA's CERRT.NG warned organisations, the press reported, against putting sensitive data into public AI platforms (ChatGPT, Claude, Gemini, Copilot, Meta AI) (Nairametrics). General information, not legal advice.
Our AI governance and security service finds the tools in use (shadow AI), checks their terms and settings, and sets up approved options. Where information must stay in-house, private AI and self-hosted models runs models on servers you control.
Sources and further reading
Product capabilities and guidance change. These are the primary sources this article relies on, checked on the review date above.
- Enterprise privacy at OpenAI, OpenAI
- Is my data used for model training?, Anthropic
- How your data is used to improve model performance, OpenAI Help Center
- Generative AI in Google Workspace Privacy Hub, Google Workspace
- Data, privacy and security for Microsoft 365 Copilot, Microsoft Learn
- Data protection in Amazon Bedrock, Amazon Web Services
- Data, privacy and security for Microsoft Foundry models, Microsoft Learn
This article is general information, not legal, accounting or security advice for your specific situation. Examples are hypothetical unless stated otherwise.