AI tools and your data: what the terms of service say that most people skip. I’ve been going through the ToS of tools our team uses and some of what I found was surprising. anyone who has done this exercise want to share what they found?
the training data clause is the one that catches most people off guard. several major tools include language that allows them to use your inputs to train or improve their models, sometimes with opt-out available, sometimes without. the default is often opt-in.
the data retention period is the other one. some tools keep your inputs indefinitely by default. some delete them after 30 days. some have different policies for free vs paid tiers. if you’re putting confidential client work or sensitive internal content into these tools, the retention period matters.
the jurisdiction clause affects what law applies to disputes and what data protections apply to your content. a tool with US jurisdiction and GDPR compliance for EU users is a different product from one that specifies a jurisdiction with weak data protection rules.
I run People Ops at a startup and we went through this exercise before approving any AI tools for team use.
the things we check: training data opt-out (is it available, is it on by default), data retention policy (how long, who can access), data storage jurisdiction, GDPR/CCPA compliance status, and whether the enterprise or team tier has different data handling than free.
the finding: the free tiers of most tools have the least favourable terms. your inputs are more likely to be used for training, retained longer, and subject to broader access rights. this isn’t hidden, it’s just in the ToS that nobody reads.
the tools with the clearest, most favourable terms for business use tend to be the ones targeting enterprise customers specifically. they’re selling data privacy as a feature.
for any tool handling client content or internal business information: read the ToS before you use it, not after.
the practical rule we use: anything that would be sensitive in an email is sensitive in an AI tool. if you wouldn’t put it in an email to a third party, don’t put it in a tool whose ToS you haven’t read.