The short answer
For business plans and developer APIs, the major AI providers state that your prompts, files and outputs are not used to train their models by default. That covers ChatGPT's business plans and the OpenAI API, Anthropic's Claude for Work and API, Gemini in Google Workspace and Google Cloud, Microsoft 365 Copilot and Azure's AI services, and Amazon Bedrock.
For personal and free accounts, the rules are different. Consumer AI services may use conversations to improve their models unless the user turns that off, which is why staff using personal accounts for work is the most common way business information ends up somewhere it should not.
Training is only part of the picture. Prompts may still be kept for a period, usually for abuse monitoring, are usually processed in another country, and can be held when the law requires it. If information must not leave your environment at all, the answer is not better terms but a private model on servers you control.
Business and consumer plans are not the same
| Provider | Business plans and APIs | Personal accounts |
|---|---|---|
| OpenAI | ChatGPT Business, Enterprise and Edu and the API: not used for training by default | ChatGPT's individual plans may use conversations to train models unless the user turns off "Improve the model for everyone"; rating a response can allow training on that conversation |
| Anthropic | Claude for Work, Claude Gov and the API: not used for training by default | Claude Free, Pro and Max users choose whether chats are used for training; chats are kept for five years if they allow it, 30 days if not |
| Gemini in Workspace and Google Cloud's Vertex AI: not used to train models without permission | The free tier of the Gemini API is used to improve Google products, and human reviewers may read it; Google warns against submitting confidential information | |
| Microsoft | Microsoft 365 Copilot and Azure's AI services: prompts and data not used to train foundation models | Personal accounts follow consumer terms; check their settings |
| Amazon | Amazon Bedrock: not used to train models and not shared with the third-party model providers | Not applicable |
These are summaries of each provider's published terms in October 2026. Terms change often (several changed in 2025 and 2026), and the details depend on the exact plan, model and settings, so check the current documents linked in the references before relying on them. Google now calls Vertex AI the Gemini Enterprise Agent Platform, and Microsoft has renamed Microsoft 365 Copilot to Microsoft Copilot.
Retention: how long your prompts are kept
Not training on your data is not the same as not keeping it. Typical practices:
- Abuse monitoring. Many APIs keep prompts and outputs for a limited period so the provider can detect misuse, then delete them. OpenAI and Anthropic, for example, state up to 30 days for their APIs, and Google states 55 days for the paid Gemini API.
- Stored features. Conversation history, uploaded files, assistants and other stored features keep data until you or your retention settings delete it.
- Workspace retention. In business plans, administrators can usually set retention rules, and logs may be kept for your own compliance purposes.
- Legal holds. Every provider reserves the right to keep data when the law requires it. In 2025, a court order in a copyright case required OpenAI to preserve consumer ChatGPT and API data, including deleted conversations. ChatGPT Enterprise and Edu customers and API customers with zero data retention were excluded, and the obligation ended in September 2025 (OpenAI).
What "zero data retention" means
Several providers offer zero data retention: prompts and outputs are processed and returned but not written to storage afterwards, even for abuse monitoring. How you get it differs:
- OpenAI and Anthropic offer it for eligible API customers, subject to approval, usually arranged through their sales teams.
- Microsoft offers modified abuse monitoring for its Foundry models to customers managed by a Microsoft account team or in an eligible programme, by application.
- Google points customers who need zero data retention to Vertex AI rather than the Gemini Developer API, and some features, such as caching and grounding with Google Search, must be turned off or avoided.
- Amazon Bedrock lets you set a zero data retention mode per region for most models.
Three limits apply everywhere. Features that store data by design, such as uploaded files, saved conversations, assistants and batch jobs, are usually outside zero data retention. Some of the newest, most capable models require temporary retention for safety monitoring whatever your agreement says. And legal obligations still apply. Zero data retention is a strong control for sensitive workloads, but your data is still processed on the provider's servers, which for Nigerian organisations are abroad.
Where your data is processed
Choosing where data is stored is not the same as choosing where the model runs, and for Nigerian organisations neither is usually in Nigeria. None of the major AI services offers processing in Nigeria: OpenAI offers in-region processing only in the US, Europe and the United Arab Emirates, Microsoft 365 does not offer Nigerian data residency, and the nearest Microsoft Azure and Google Cloud regions are in South Africa. Prompts that contain personal data are therefore transfers outside Nigeria, which need a lawful basis under the Nigeria Data Protection Act 2023 (NDPA) and usually a data protection impact assessment (DPIA) under the NDPC's GAID 2025. Cloud platforms' "global" or cross-region routing can also send prompts to other countries for capacity or cost reasons, so regulated workloads should be pinned to a specific region where the model is offered, with the transfer basis recorded.
Rather talk it through? If you are not sure what your AI tools keep or where they process data, we can check the terms and settings for each one. Talk to a Promatics specialist
Three levels of control
| Level | How it works | Who processes your prompts |
|---|---|---|
| Business plan or API with standard terms | No training on your data; prompts kept for a limited period | The provider |
| API with zero data retention, or models in your own cloud account | No training, nothing stored after the response (with limited exceptions), or processing under your cloud agreement in a region you choose | The provider or your cloud provider |
| Private, self-hosted model | An open-weight model on GPU servers you control, which can be in Nigeria | Only your organisation |
Models offered through your cloud provider are an example of the middle level. AWS states that Amazon Bedrock prompts and outputs are not used to train models and are not shared with the third-party model providers (AWS), and Microsoft states that prompts sent to the models it sells through Azure are not available to OpenAI or other model providers (Microsoft Learn). The third level is the only one that can keep AI processing in Nigeria, on your premises or in a Nigerian data centre. Our comparison of self-hosted models and AI services explains when it is worth it.
Questions to ask about every AI tool
- Is this a business plan or a personal account?
- Are our prompts, files and outputs used to train or improve models, and is that off by default?
- How long are prompts and outputs kept, and for what purpose?
- Is zero data retention available for our use and the model we chose, and which features does it exclude?
- Who at the provider can review our data, and when?
- Where is data stored, where is it processed, and what is our lawful basis for sending it outside Nigeria?
- Which sub-processors and third-party model providers receive data?
- Can we export or delete our data, and how quickly is it deleted?
- Does any of our information need to stay entirely in our own environment, or in Nigeria?
When to bring in help
Checking the terms of one approved tool is manageable. Bring in help when staff use many AI tools, some of them personal accounts, when client or personal information is involved, or when clients and regulators start asking how AI is controlled. The NDPA applies to personal data entered into AI tools, including its rules on transfers outside Nigeria. In October 2026 NITDA's CERRT.NG also warned organisations, as reported in the press, against putting sensitive data into public AI platforms such as ChatGPT, Claude, Gemini, Copilot and Meta AI (Nairametrics). Our overview of AI and the NDPA sets out what applies. This is general information, not legal advice.
Our AI governance and security service finds the AI tools in use (shadow AI), checks each one's terms and settings, and sets up approved options. Where information must stay in-house, our private AI and self-hosted models service deploys models on servers you control.
Sources and further reading
Product capabilities and guidance change. These are the primary sources this article relies on, checked on the review date above.
- Enterprise privacy at OpenAI, OpenAI
- Is my data used for model training?, Anthropic
- How your data is used to improve model performance, OpenAI Help Center
- Generative AI in Google Workspace Privacy Hub, Google Workspace
- Data, privacy and security for Microsoft 365 Copilot, Microsoft Learn
- Data protection in Amazon Bedrock, Amazon Web Services
- Data, privacy and security for Microsoft Foundry models, Microsoft Learn
This article is general information, not legal, accounting or security advice for your specific situation. Examples are hypothetical unless stated otherwise.