Guides · ← All guides
Is My Data Training Their Model? How to Check Any AI Vendor's Policy in 20 Minutes
Last updated: October 13, 2026 · 9 min read
This guide is informational, not legal advice.
"Does this tool train on my data?" It's the most-asked question in AI vendor risk, and the hardest to answer reliably — not because the answer is secret, but because it's scattered. The vendor's marketing says "enterprise-grade privacy." The help center says "you can opt out." The terms say "we may use data to improve our services." Three documents, three different answers, and only one of them is binding.
Here's a five-step method that gets you the real answer for any vendor in about twenty minutes. We've used it across dozens of AI tools. It works because vendors are predictable: they hide the answer in the same places, with the same vocabulary, every time.
Step 1: Find the right documents (4 minutes)
Don't start with the marketing page. Don't start with the blog post titled "Our Commitment to Privacy." Start with the documents that create obligations:
- The Terms of Service — usually linked in the website footer. This is where the license you grant the vendor lives.
- The Privacy Policy — same footer. Training-data disclosures hide here more often than in the ToS, because privacy policies are where "how we use information" sections live.
- The Data Processing Addendum, if one exists — sometimes linked from the privacy policy, sometimes only in the trust center. This is the document with the strongest commitments.
- The help center article on data usage or training opt-outs. Search the vendor's help site for "train" or "opt out." Not legally binding, but it tells you what the vendor thinks its policy is — and where the toggles are.
Open all four in tabs. Note each document's "last updated" date as you go. If the privacy policy was updated recently and the training language is vague, that's your signal to read slowly.
Step 2: Run the ten-phrase search (5 minutes)
In each document, search for these phrases in order. They map to the vocabulary vendors actually use:
"train" — the direct hit. You're looking for "train our models," "training data," or "used to train."
"improve" — the euphemism. "Use data to improve our services" is the most common way vendors describe training without saying training.
"machine learning" / "ML" — catches disclosures phrased as model development rather than training.
"develop" — as in "develop and improve our products." Same family as "improve."
"opt-out" / "opt out" — if training happens, this tells you whether you can stop it and how.
"retain" / "retention" — how long inputs are kept. Training-adjacent: long retention plus vague use language is a bad combination.
"human review" — whether people may read your inputs.
"share" — who else gets the data, including subprocessors and affiliates.
"de-identif" — vendors often promise training only on "de-identified" or "aggregated" data. Note exactly what they claim to strip.
"delete" / "deletion" — whether you can get data removed, and on what timeline.
Read every hit in context — the sentence before and after, not just the highlighted phrase. Vendors love the structure "we do X, except when Y," and the exception is always where the meaning lives.
Step 3: Classify the answer (3 minutes)
After the searches, the vendor's position will fall into one of three buckets. Name it explicitly — writing it down forces honesty:
Clear no. The terms state, without qualification, that inputs are not used for training. Example shape: "We do not use Customer Data to train or improve our models." Business and API tiers from major vendors often land here. Verify the sentence applies to your tier — some vendors carve out free tiers in a separate paragraph.
Yes, with an opt-out. Training is on by default; you can turn it off. Now grade the opt-out: a settings toggle you can flip in ten seconds is a real opt-out. An email to support is friction designed to reduce opt-outs — Slack's May 2024 policy required a workspace owner to email the company with a specific subject line, which is the textbook example. An opt-out buried in an enterprise amendment that self-serve customers can't access is barely an opt-out at all.
Ambiguous. "We may use data to improve our services." No mention of training, no opt-out described. Treat this as a yes until proven otherwise. Then move to Step 5, because ambiguity in the documents means you need the answer in writing from the vendor.
Step 4: Test the settings yourself (5 minutes)
Documents describe the policy; settings describe the reality. Log in to the tool and check:
- Account / workspace settings for anything labeled data controls, privacy, training, or improvement. Flip every training-related toggle off, and screenshot the before and after.
- Whether the toggle exists on your tier. Some vendors only expose data controls on paid plans. If the setting isn't there on free, that's your answer about the free tier's data deal.
- What the toggle actually promises. Read the microcopy next to it. "Turn off to exclude your data from training" is clear. "Help improve the product" with no further explanation is not — and a toggle with vague copy deserves a Step 5 email.
- API vs. web settings. If your team uses the API, check whether the API has separate data controls or inherits the workspace settings. We've seen vendors where the web toggle doesn't cover API traffic.
While you're in there, check who else in your organization has accounts. If three teammates signed up individually on free tiers, each of them has a separate data relationship with the vendor — and your workspace-level opt-out may not cover them.
Step 5: Ask the vendor in writing (3 minutes to send)
If the documents are ambiguous, or the settings don't match what the documents promise, email the vendor. Written answers create a record; chat support doesn't. Here's a template that works:
Subject: Data training policy question — [your company name], [plan tier]
"Hi — we're evaluating [product] for [use case, e.g., processing customer support tickets]. Could you confirm in writing: (1) Is data we submit through [web app / API / both] used to train or improve your models, including non-generative ML models? (2) If so, what is the exact opt-out mechanism for our tier, and does it cover API traffic? (3) What is your data retention period for our inputs, and can we request deletion on a defined timeline? Thanks."
Question 1's "including non-generative ML models" is doing real work — it closes the exact loophole Slack used in 2024, when the controversy turned on the distinction between generative AI training and traditional ML. Ask about both, explicitly.
File the reply with your dated copies of the terms. If the vendor's email contradicts its terms, believe the terms — but keep the email, because it shows what you were told.
The tier trick, one more time
Run this whole method on the tier you're actually using, not the tier the vendor advertises. The most common pattern in the industry: free trains, paid doesn't. The second most common: everything trains unless you find the toggle. Either way, the answer for "the product" and the answer for "your account" can differ — and it's your account's answer that governs your data.
FAQ
What if the vendor says training uses only "anonymized" data?
Ask what they strip, and whether the stripping happens before or after human review. "Anonymized" has a specific legal meaning in some jurisdictions that vendors' engineering processes don't always meet. Treat the claim as a starting point, not an answer.
Does turning off "chat history" stop training?
On some platforms the two are linked — disabling history also opts you out of training. On others they're separate settings. Don't assume; check both, and confirm in the documents.
How often should I re-run this check?
Whenever the "last updated" date changes on any of the four documents, and quarterly regardless. Training policies are among the most frequently flipped clauses in AI terms — which is exactly why watching them beats reading them once.
What if I can't find any training language at all?
That's an answer too — and not a reassuring one. A vendor with no stated training policy is a vendor that hasn't constrained itself. Send the Step 5 email.