AI tools’ terms of service say a lot about what happens to your text. I’ve been going through several of the tools we use and some of what I found was worth paying attention to. has anyone else done this exercise?
the training data clause is the one that catches most people. several major tools include language allowing them to use your inputs to train or improve their models, sometimes with an opt-out, sometimes without. the default is often opt-in. you have to actively turn it off.
for content teams: the data retention period matters. some tools keep your inputs indefinitely by default. some delete them after 30 days. for client content or anything confidential, the retention period is a real business concern, not an abstract one.
the jurisdiction clause: what law governs the relationship and what data protections apply. a tool with US jurisdiction and GDPR compliance for EU users is a different product from one that specifies a jurisdiction with weaker data protection rules. relevant for anyone handling content from EU-based clients.
in our onboarding process we now require anyone adding an AI tool to the team stack to confirm they’ve read the ToS and flagged any concerns. the tools with the most favourable terms for business use tend to be the enterprise-targeted ones. the free tiers often have the worst terms by design.
the things worth checking in any AI tool ToS before putting business content into it:
-
training data: can they use your inputs? is there an opt-out? is it on by default?
-
data retention: how long is your content kept? who can access it during that period?
-
jurisdiction: what law applies? does it match the regulatory requirements for your content?
-
confidentiality: any explicit confidentiality obligations on their side?
-
free vs paid tier differences: the paid tier often has better data handling. check whether upgrading changes the terms meaningfully.
the rule we use: anything you wouldn’t put in an email to a third party, don’t put in a tool whose ToS you haven’t read.