Does Gemini use your data? An Irish guide to Google's rules
· Updated · Written and maintained by Joaquín Trapero, Nonimo
Yes, on a personal account, and the full answer has three parts that people usually lump together. Google uses Gemini conversations to run the service, to improve its machine learning models, and to keep the service safe. Human reviewers read a subset of them. And turning the main setting off stops the second use without stopping the other two.
For a firm in Ireland there is a fourth part that changes the frame. Gemini Apps here are not provided by an American company. Google’s own notice says they are provided by Google Ireland Limited in the European Economic Area and Switzerland, and the regulator that has already opened a statutory inquiry into Google Ireland over an AI model is the Data Protection Commission in Dublin.
Who provides Gemini in Ireland, and why that matters
The first line of Google’s Gemini Apps Privacy Notice, last updated on 29 June 2026, does more work than its length suggests: Gemini Apps are provided by Google Ireland Limited in the EEA and Switzerland, and by Google LLC everywhere else.
That makes an Irish company the controller for your prompts, which puts the whole question inside Irish and EU law rather than at the end of a transfer chain. It also means the regulator is local, and unlike some of its peers it has already acted. Our guide to whether putting client data into an assistant is a breach sets out the notification test that follows from that.
What Google actually collects when you use Gemini
The list in the notice is longer than most people picture, and the length is the point. It is not just what you typed.
| Category | Examples Google gives |
|---|---|
| What you provide | Prompts, files, videos, screens you ask about, imported chats, feedback |
| What Gemini generates | Text, code, images, citations, chat summaries, model thinking steps |
| Connected sources | Connected Apps, Search or YouTube history, page context and URL from Chrome |
| Device and mobile | Call and message logs, contacts, installed apps, screen content, location |
Source: Google, Gemini Apps Privacy Notice, 29 June 2026.
The mobile rows are the ones that matter in a professional setting, because nobody reads them before installing an app on a work phone. If Gemini is set as the device assistant, the notice contemplates call and message logs, contacts and screen content. That is simply how an assistant works, and it belongs in the written rule that our AI policy template produces.
Human reviewers, and the sentence Google puts in writing
This is where Google is blunter than its competitors, and the bluntness deserves credit rather than alarm. The notice does not hedge.
Who the reviewers are, and what they do
A subset of chats is read by human reviewers, including trained reviewers from Google’s service providers. They assess whether responses were low quality, inaccurate or harmful, and suggest better ones. Chats are also reviewed to enforce the terms of service and the prohibited use policy. Before a chat goes to a service provider it is disconnected from your account.
Three years, and they survive your deletion
For a firm, this changes what “delete” means. Chats that have been read by human reviewers, and related data such as your language, device type, location information or feedback, are not deleted when you delete your activity. They are retained for up to three years.
A firm that tells a client “we deleted the conversation” has made a statement about their own account, not about Google’s systems. It is accurate as far as it goes, and it does not go as far as most people think. What the other three assistants keep after you delete a chat is set out in our other guides.
Training and passing through your data are not the same question
Every one of these four products has a switch that people treat as an eraser, and Gemini’s is the clearest example of why that reading fails.
What turning Keep Activity off actually stops
It stops your future chats being used to improve Google’s services with help from human reviewers, and it stops them being saved to your activity. If you also avoid submitting feedback, Google says it does not use your future chats to improve its AI models. Temporary chats are not used to train the models at all.
What it does not stop
Google spells this out rather than leaving it to be inferred. Even with Keep Activity off, or in a temporary chat, Google still uses your chats to respond to you and to help protect Google, its users and the public, including with help from human reviewers. Those chats are retained with your account for 72 hours.
There is also a line in the settings section that most readers skip: your Gemini settings do not control the processing of your chats to create anonymised data to improve Google services.
| The event | Does the switch reach it? |
|---|---|
| Improving models with human review | Yes, Keep Activity off stops it |
| Saving the chat to your activity | Yes |
| Responding to you, and protecting Google and the public | No |
| Retention of 72 hours with your account | No |
| Anonymised data created to improve Google services | No |
Source: Google, Gemini Apps Privacy Notice and Privacy Hub, 29 June and 10 August 2026.
A switch that governs one pipeline does not govern the others, and none of them undo the fact that the document left your office in the first place. That is the question our guide to whether a paste is a breach is written to answer, and it starts before any setting.
The legal basis Google relies on in the EU
This detail only shows up in the European version of the page, and it is the one your own record of processing should reflect.
For using chats to improve models and to develop new products, Google relies on the legitimate interests of itself and third parties, with safeguards. It relies on contract to provide the service, on legal obligation where one applies, and on consent for specific features such as Voice Match, Memory, and allowing audio and Live recordings to improve Google services.
Legitimate interests is a lawful basis, and it is also the one that carries a right to object under Article 21 of the GDPR. That right belongs to the people in your documents as much as to you, which is the practical reason a professional should not be the one deciding to hand their data over.
It matters for a second reason that is specific to this market. Whether legitimate interests is the right basis for training an AI model is exactly one of the four questions the Irish regulator put to the European Data Protection Board in 2024, and the answer it received now frames how every one of these four companies has to argue its case. The EU AI Act guide covers the second regime that now runs alongside this one.
How long Gemini keeps your chats
Retention on a personal account is a setting, not a fixed number, and the default is longer than people assume.
Three other things sit outside that setting. Reviewed chats last up to three years regardless. Some data is kept until you delete your Google Account, such as how often you use Gemini Apps. And data used in other Google services you reached through Gemini follows those services’ own policies, so deleting Gemini activity does not delete it there.
The default is the number worth pausing on. Eighteen months is longer than most engagements, longer than many retention schedules for correspondence, and longer than the period a firm would keep a draft it decided not to send. Nobody chose it; it is what the product does if nobody touches it, and that is the strongest argument for touching it on day one.
That last one catches people who use Gemini inside Chrome or alongside Workspace, and it is the kind of thing an external IT provider should be checking rather than the partner who signed the subscription.
Ads, and the one answer that is a flat no
Google’s answer here is shorter than any of the other three, and it is worth quoting because theirs are more qualified.
Your Gemini Apps chats are not being used to show you ads, and Google says that if this changes it will clearly communicate it. There is no consent screen, no personalisation toggle and no exception for a free tier.
That is a genuine difference. OpenAI’s Europe policy of 24 August 2026 now describes using past chats to personalise ads for Free and Go users, on the basis of consent, and our ChatGPT guide covers what that means for a firm. On this one point Gemini is the simpler answer.
Gemini at work: what a Workspace account changes
Almost everything above describes a personal Google account. A qualifying Workspace edition is a different product with different commitments, and the difference is large enough that comparing the two is the first thing a firm should do.
The commitments Google makes to Workspace customers
Google states that your interactions with Gemini stay within your organisation, that your content is not used for other customers, and that your content is not human reviewed or otherwise used for generative AI model training outside your domain without permission. Prompts, responses and Workspace content are not used to train models without your permission.
Read the qualifiers as written. “Outside your domain” and “without permission” are doing real work, and they are a plain statement of the limits, not a loophole. The commitment is a processor commitment under the Cloud Data Processing Addendum, which is the document your clients and your insurer will ask you to name.
Retention becomes your administrator’s decision
| Product | Data | Retention |
|---|---|---|
| Gemini in Workspace | Prompts and responses | 90 days to indefinite, set by admins |
| Gemini app on Workspace | Prompts and responses | Up to 36 months, set by admins |
| Gemini Notebook | Prompts and responses | Not retained after the session ends |
| Gemini Notebook | Uploaded files and notebooks | Follows the Cloud Data Processing Addendum |
Source: Google, Generative AI in Google Workspace Privacy Hub, 14 August 2026.
Notebook, and the setting that does not apply to it
One line in that hub is easy to miss and matters in a regulated practice. When a user uploads sources from Drive into Gemini Notebook, a new copy of each file is created and stored with the Notebook data, and your organisation’s file sharing and data region settings do not apply to data in Gemini Notebook.
A firm that bought data regions for Europe and then used Notebook for a client bundle has an exception it did not know about. Google publishes it, but it is the sort of sentence nobody reads until an audit.
Where Irish data sits, and what data regions do not cover
What the feature covers, and on which editions
Google Workspace data regions let you choose the United States or Europe for covered data, and the coverage is better than people expect: prompts and responses for both the Gemini app and Workspace with Gemini are covered at rest and during processing.
That is a stronger commitment than most of the other providers make, because processing and storage are usually separate promises and here they are both listed. It is also an edition feature rather than a setting, which is the part a firm gets wrong when it assumes the box is ticked. The cyber questionnaire guide covers how to answer the residency question on a form without overclaiming.
The limits are published in the same document. Data regions cannot be applied to data types not listed, such as logs or cached content. The Enterprise tier of the feature comes with Frontline Plus, Enterprise Plus or the Data Regions option bought separately, so a Business Standard subscription does not get the full version.
The conclusion is the same for all four assistants. Choosing Europe changes where a copy rests, which is a real improvement and worth paying for. It does not change the fact that the client’s letter left your office, and it is not an answer to the question of whether it should have.
The DPC has already opened an inquiry into Google Ireland
None of the other three companies has anything like this in Ireland, and it is a matter of public record rather than inference.
Section 110, and a Data Protection Impact Assessment
On 12 September 2024 the Data Protection Commission announced a cross-border statutory inquiry into Google Ireland Limited under section 110 of the Data Protection Act 2018. The question is whether Google complied with any obligation it may have had to carry out a Data Protection Impact Assessment under Article 35 of the GDPR before processing the personal data of EU and EEA people to develop its foundational model, PaLM 2.
An inquiry is not a finding, no decision has been published, and nothing here says Google did anything wrong. What it establishes is the address. The authority that decides whether a Data Protection Impact Assessment was required for an AI model developed by Google is in Dublin.
The same instrument is available against anyone else established here. Section 110 lets the DPC open an inquiry on its own initiative, and this one was announced as a cross-border inquiry, meaning it runs under the one-stop-shop mechanism for people across the EEA.
An Irish firm reading this is inside the jurisdiction where the question is being decided rather than watching from outside, which is a better position than it sounds. Our Irish cyber cover guide sets out what an insurer here already asks about AI.
The opinion that Dublin asked for
There is a second, larger thread. In September 2024 the DPC used Article 64(2) of the GDPR to ask the European Data Protection Board for an opinion on personal data in the development and deployment of AI models. The Board delivered it on 17 December 2024.
For scale, the same office took in 6,521 valid breach notifications in 2025. The DPC’s four questions to the Board included when an AI model may be considered anonymous, and how a controller shows that legitimate interests is the right basis for developing and for deploying one. Given that legitimate interests is exactly what Google relies on for Gemini in Europe, the Irish regulator asked the question that governs the product before anybody else did.
What Irish professional rules ask of you
On 12 November 2025 the Law Society of Ireland published guidance on generative AI, written against the Solicitors’ Guide to Professional Conduct. It names Gemini among the four systems it covers, and it does not distinguish between them. The High Court, the Court of Appeal and the Circuit Court have since each added a practice direction of their own, and whether an Irish solicitor can use any of the four on a client matter now turns on those as well.
Its central line is about versions rather than vendors: free and paid consumer versions are not suitable for securely handling personal data or client confidential data by default. It adds that solicitors should never assume an enterprise tool guarantees compliance, and asks for due diligence and a detailed review of the terms.
For Gemini that maps unusually cleanly onto the two products described above. The personal account is the consumer version the guidance is warning about, complete with human reviewers and a three year tail. The Workspace edition is the enterprise tool the guidance says still needs checking. Knowing which one your staff are signed into is most of the work, and our AI policy template starts there for that reason.
Privilege, and the reviewer who is not in your firm
The guidance also warns that intentionally giving privileged communications to a free or paid model without appropriate safeguards may lose the benefit of privilege, as an intentional release to a third party outside the firm. Gemini is the product where that argument is easiest to make concretely, because Google has told you in writing that a person may read it. The High Court has since put the same risk into a practice direction of its own.
How to change the settings, and what to check first
- Establish which account. A personal Google account and a Workspace seat are different products with different commitments, and only one of them rules out training.
- Open Gemini Apps Activity. Review what is there, set the auto-delete period, and decide whether Keep Activity stays on.
- Remember what Keep Activity does not reach. Reviewed chats last three years and survive deletion, and the 72 hour retention applies either way.
- Check Connected Apps. Each one is a route in and out, and Google does not monitor or secure data from custom connections to other companies’ services.
- Ask your administrator about data regions. They are an edition feature, not a default, and logs and cached content are outside them.
- Write the rule down and collect the acknowledgements. An unsigned rule is difficult to enforce, and the template ends with a signature block for that reason.
- Diary the review. Three of the Google documents behind this guide carry 2026 dates. A setting you checked last winter is not one you can describe to a client today.
How to answer a client who asks whether you used Gemini
Sooner or later somebody will ask, and a vague answer is worse than an awkward one. The answer has four parts, and all of them are on this page. In a local authority the same question arrives from a resident and three separate regimes point at the answer, which makes it a different exercise.
| What the client wants to know | Where the answer comes from |
|---|---|
| Which account was it on | Your own records, and this is the part that decides everything else |
| Could a person have read it | Yes on a personal account, no outside your domain on Workspace |
| How long does it exist | Your auto-delete setting, and three years if a reviewer read it |
| Where is it stored | Europe if data regions are on, and not for Notebook data |
A firm that can answer those four in writing is in a different position from one that can only say it deleted the chat. The DPC’s own AI guidance of 18 July 2024 asks the same questions in the same order, and it is written for the organisation using the system rather than for Google. Getting them on paper once is cheaper than being asked twice.
Those dates are not decoration. Two of the three changed within the last three months, and the answers above are only as current as the page they came from. Our other guides give the dates of the documents behind them in the same way.
What a tool can do here, and what no tool can do, including ours
Software of this category masks identifiers before the text is sent. It does not make an organisation compliant, because compliance is a property of an organisation and not of a product, and no Irish regulator has named a tool. What ours does is pseudonymisation: the mapping back to the person is kept, encrypted, on your own machine, so it is reversible by design and the result is still personal data under the GDPR.
The reviewer problem that masking does not solve
Gemini makes the limit of this category unusually easy to see. Suppose every name and number is masked before the text is sent, and a human reviewer at a service provider later reads the conversation. What they read is a coherent account of a dispute, a medical history or a family arrangement, with the labels changed. A referral letter shows it most plainly, because the clinical story is the whole point of the letter.
Identifiability is a property of the whole document, not of the words that were removed. A specific address, a named previous adviser and a county will place a matter for anyone who has seen the file, and often for anyone in the same town. That argument cuts against our own product, and we would rather write it than have a client find it.
Our Irish results, both halves
The Irish layer of our engine has been measured against typical Irish office documents, using the settings it ships with. Most of the seeded identifiers were fully masked, some only in part and some not at all, and a few of the decoys that should have been left alone were masked anyway. It came out as the weakest of the layers we ship. A detection rate quoted without its false positives is a sales claim, which is why we give both halves.
Most of the partial cases came from one missing abbreviation. “Co.” made the engine read the full stop after it as the end of a sentence, so the address was cut short and the county stayed visible while the panel reported the address as covered. Adding the abbreviation fixed most of them, without moving any other market and without touching a single extra decoy. Half a masked address is, by our own written rule, worse than none.
There are Mac and Windows apps, with a free plan limited to 200,000 words a month, and the engine runs on the machine under a policy step that IT sets, not each user. Across a firm, IT adds a browser extension deployed by policy, a compliance panel and a monthly report.
If your answer is to move to a Workspace account and write one page of rules, that is a good answer and it costs nothing extra. Our organisations page is for the firms that get there and want the control as well. The same questions for the other three assistants are answered in our ChatGPT guide, our Claude guide and our Copilot guide.
Sources
- Google, Gemini Apps Privacy Notice, last updated 29 June 2026. Gemini Apps provided by Google Ireland Limited in the EEA and Switzerland; the categories of data collected; human reviewers and the warning not to enter confidential information; auto-delete default of 18 months and the 3, 36 and indefinite options; reviewed chats retained up to three years and not deleted with your activity; settings do not control anonymised data processing. Source
- Google, Gemini Apps Privacy Hub, last updated 10 August 2026. The EU and UK legal bases, including legitimate interests for improving models and consent for named features; “Your Gemini Apps chats are not being used to show you ads”; reviewed chats retained up to three years and disconnected from your account; temporary chats and Keep Activity off retained for 72 hours with the last 24 hours used as context. Source
- Google, Generative AI in Google Workspace Privacy Hub, last updated 14 August 2026. Interactions stay within your organisation; content not human reviewed or used for model training outside your domain without permission; the retention table for Gemini in Workspace, the Gemini app and Gemini Notebook; file sharing and data region settings do not apply to Gemini Notebook data. Source
- Google Workspace Admin Help, Data covered by data regions, consulted 19 September 2026. Gemini app and Workspace with Gemini prompts and responses covered at rest and during processing; the United States or Europe as the choice; editions that include the feature; data regions cannot be applied to data types not listed, such as logs or cached content. Source
- Data Protection Commission, Data Protection Commission launches inquiry into Google AI model, 12 September 2024. A cross-border statutory inquiry into Google Ireland Limited under section 110 of the Data Protection Act 2018, on whether a Data Protection Impact Assessment was required under Article 35 before developing PaLM 2. Source
- Data Protection Commission, welcome for the EDPB opinion, 18 December 2024. The opinion was sought by the DPC in September 2024 under Article 64(2) GDPR; the four questions, including when an AI model may be considered anonymous and how legitimate interests is demonstrated for development and deployment. Source
- Data Protection Commission, Annual Report 2025, published 30 June 2026. 6,521 valid breach notifications received in 2025; 16,160 new cases from individuals, up 45 per cent. Source
- Data Protection Commission, AI, Large Language Models and Data Protection, 18 July 2024. What an organisation should understand before using an AI system, including where personal data goes when a third party is involved and whether it is retained or reused. Source
- Law Society of Ireland, guidance on generative artificial intelligence, December 2025. Names Gemini among the systems covered; free and paid consumer versions not suitable for securely handling client confidential data by default; never assume an enterprise tool guarantees compliance; privilege may be lost by intentional release to a third party. Source
Nonimo is the software that does this on your own computer: it masks client names and IDs before your text reaches ChatGPT . No account, and your client's details never leave your machine.
Common questions
Does Gemini use your data to improve Google's models?
Yes, on personal accounts, unless you turn Keep Activity off. Google's Gemini Apps Privacy Notice of 29 June 2026 says these uses extend to the generative AI models powering its services, and that human reviewers read some of the data collected.
Do humans read Gemini conversations?
A subset of them. Google says trained reviewers, including reviewers from its service providers, read some chats to improve its services and to enforce its terms. Chats are disconnected from your account before being sent to service providers.
How long does Google keep Gemini chats?
The default auto-delete period is 18 months, and you can change it to 3 months, 36 months or indefinite. Chats read by human reviewers are kept for up to three years and are not deleted when you delete your activity.
Does turning off Keep Activity stop Google using my chats?
Not entirely. Google says that even with Keep Activity off, it still uses your chats to respond to you and to protect Google, its users and the public, including with help from human reviewers. They are kept with your account for 72 hours.
Who provides Gemini in Ireland?
Google Ireland Limited. The Gemini Apps Privacy Notice states that Gemini Apps are provided by Google Ireland Limited in the European Economic Area and Switzerland, and by Google LLC everywhere else.
Does Google use Gemini chats to show me ads?
Google's answer is a flat no. Its privacy hub states that Gemini Apps chats are not being used to show you ads, and that if this changes it will clearly communicate it. That is the plainest answer any of the four providers gives.
Is Gemini in Google Workspace treated differently?
Yes. Google states that your content is not human reviewed or used for generative AI model training outside your domain without permission, and that prompts and responses stay within your organisation. Retention is set by your administrator.
Has the Irish regulator investigated Google over an AI model?
Yes. On 12 September 2024 the Data Protection Commission opened a cross-border statutory inquiry into Google Ireland Limited under section 110 of the Data Protection Act 2018, about a Data Protection Impact Assessment for the PaLM 2 model.
Can I keep Gemini data in Europe?
Only with the right Workspace edition. Data regions cover prompts and responses for the Gemini app and Workspace with Gemini, at rest and during processing, but they cannot be applied to logs or cached content, and Gemini Notebook is outside them.