Does ChatGPT share your data? Who gets it and for how long

Everything you send ChatGPT reaches OpenAI, and some of it can travel further. OpenAI’s privacy policy names who else may receive it: the companies running its servers and support desk, its affiliates, authorities that ask, a buyer if the business changes hands and, on a work plan, whoever administers your workspace.

This guide works through that list, then ads on the free plans, training, how long copies last, which OpenAI company answers to you and where the data sits. Few readers, I suspect, expect the employer. If a client’s details have already gone in, whether that counts as a breach is a separate question.

Who does ChatGPT share your data with?

OpenAI runs two privacy policies: one for the EEA, the UK and Switzerland, and one for everyone else. The second opens its disclosure list with vendors and service providers: hosting, cloud, customer support, safety, analytics, payments, search and shopping providers, and age or identity checks.

Next come affiliates, the counterparties if OpenAI is sold or restructured, and government authorities or other third parties. That last heading is wider than a court order. It covers legal obligations, protecting OpenAI’s rights, breaches of its terms, fraud, safety and liability.

The heading people overlook is the employer. Sign up personally with a work email and OpenAI may tell your organisation the account exists. Settling which accounts staff use is my first step, with the provider who manages your IT if you have one.

Does OpenAI sell your data or use your chats for ads?

No sale, on OpenAI’s word. Its policy for readers outside Europe has a section for US state privacy laws: OpenAI doesn’t “sell” personal data, doesn’t “share” it for cross-context behavioural advertising and doesn’t process it for “targeted advertising”. The quotation marks are there because those are defined legal terms.

Ads inside ChatGPT are a separate matter. OpenAI’s European policy covers them for Free and Go users. Personalised ads need your consent and can draw on past chats, while generic ads rest on legitimate interest and use the current chat, your location, time of day and device type.

I’d flag the generic route: it needs no consent. A question about a debt or a diagnosis, typed into a free account, becomes ad context. Advertisers get aggregate reporting such as views and clicks, the policy says, not the chat itself. Leaks that have nothing to do with advertising have their own guide.

Can your employer or workspace admin read your ChatGPT chats?

On a work plan, yes. OpenAI’s privacy policy says administrators of a business or Enterprise account can access and control your account, including the content in it. How much each admin console shows differs by plan, so ask whoever runs your workspace what they can open.

Files are within reach too. OpenAI’s Library help page says compliance admins can export or delete files saved in Library through the Compliance API, and workspace owners can stop ChatGPT referring to Library files on its own. An upload sits with the workspace as much as the chat does.

New staff should hear on day one, as I see it, that a work chat is a work record. That isn’t sinister, but people write differently once they know. It belongs in the AI rules every member of staff signs, beside the list of what never goes in.

Does OpenAI train its models on what you type?

On personal plans, it can. OpenAI’s help article on model improvement names Free, Plus and Pro: content may train its models unless you turn off “Improve the model for everyone” in Settings, Data controls, or pick “Do not train on my content” in the privacy portal. Either one is enough.

Business, Enterprise, Edu and the API work the other way: no training by default, though an API organisation owner can opt in to data sharing. On personal plans one caveat outlives the switch. A thumbs up or down can still send the whole conversation behind it into training.

Few people treat a rating as a disclosure, and I’d brief staff that it is one. Training data can travel, too: on 25 September 2026 OpenAI said agents in its research environment sent training and evaluation data to outside services, 53 user-provided images among it. What that means for uploads sits with the photos.

How long does OpenAI keep ChatGPT conversations?

Saved chats stay until you delete them, or until a workspace retention policy removes them. Deletion is then scheduled within 30 days, unless the chat was already de-identified and separated from your account, or OpenAI must keep it for security or legal reasons. Temporary chats may be kept up to 30 days for safety.

OpenAI’s European policy spells out the longer cases: banned content or accounts, a legal duty such as a subpoena, payment records, and the record of your own erasure request. And a deleted chat is gone for you: neither ChatGPT nor OpenAI Support can restore it.

I read 30 days as the normal ceiling, not a guarantee for every copy. Library files and memories need separate clearing, and a walkthrough for wiping ChatGPT clean takes each in turn.

Which OpenAI company answers to you: Dublin or San Francisco?

The controller clause is short. If you live in the EEA or Switzerland, OpenAI Ireland Limited in Dublin is responsible. Anywhere else, the policy names OpenAI OpCo, LLC in San Francisco. The UK sits awkwardly: British users are sent to the European version of the policy, yet the UK isn’t in the EEA.

The Irish company matters for Europe’s enforcement too. The EDPB’s ChatGPT taskforce found that OpenAI had no EU establishment until 15 February 2024 and a single one from that date, so the GDPR’s one-stop-shop applies. OpenAI’s policy names the Irish Data Protection Commission as its lead supervisory authority.

Read literally, the clause gives a British firm European paperwork and a Californian counterparty. Whether that reading holds is for OpenAI or a lawyer to say; my advice: get OpenAI’s answer in writing, kept with the record of processing. How EU rules follow firms beyond the EU is a similar puzzle on the AI side.

Where is ChatGPT data stored, and can it stay in your region?

OpenAI’s European policy says it processes personal data on servers outside the EEA, Switzerland and the UK, including in the United States. It relies on adequacy decisions, the EU Standard Contractual Clauses and the UK’s addendum to them. The Commission’s adequacy for the US covers only organisations in the Data Privacy Framework.

Keeping data in one region is a contract question, not a setting. If a client has been told their file stays in one country, find the plan and the clause that promise it, and ask what processing still happens elsewhere. A personal account bought on a card gives you nothing to point to.

Residency tells you where the copy rests, not who can be asked for it. For API traffic I’d sooner change what leaves: Nonimo Gateway takes the personal data out of each request on your own server before it reaches OpenAI.

Privacy law on recipients: GDPR, CCPA and the FTC

In the EU and UK, the GDPR makes the list of recipients something you’re entitled to. Article 13 requires a controller to name “the recipients or categories of recipients”, and Article 15 lets you ask which ones received yours. The EDPB’s taskforce adds that OpenAI can’t shift responsibility for inputs onto users.

For US readers, California’s CCPA is the plainest example: consumers can ask a covered business for “the categories of third parties” it discloses their data to, twice a year for free, as the state’s privacy agency explains. FTC staff warned in January 2024 that AI model-as-a-service firms may be liable for broken privacy promises.

Pasting a client’s details is still your disclosure, and Article 28 of the GDPR expects a written contract and sufficient guarantees from any processor you use. A staff member’s personal account is not that contract, so I’d ban client files from them outright. An insurer asking how your staff use AI will want to know.

Before the next paste: shrink what OpenAI receives

The hosting vendor, an affiliate, a court, a buyer, your admin: each can only hold what reached OpenAI, which is why I put sending less ahead of any setting. No names, account numbers or client references, and no file carrying an author’s name in its hidden properties.

For the text itself, Nonimo’s desktop app swaps names and identifiers for placeholders on your Mac or Windows machine before the chat box gets them. Whoever sits on OpenAI’s list would see [PERSON_1], not your client, and the originals return when you copy the answer.

Because the swap is local, the text doesn’t pass through Nonimo either; our notes on what the app sends us go into that. The box below shows what your own draft would hand that list as it stands.

Sources

• OpenAI, Privacy Policy, updated 6 February 2026: recipients, no sale or targeted advertising, business admins, controller.
• OpenAI, Europe privacy policy, updated 24 August 2026: ads and their legal bases, retention, complaint routes, transfers, controller clause.
• OpenAI Help Center: How your data is used to improve model performance; Chat and file retention in ChatGPT; Using Library to manage files in ChatGPT; Memory in ChatGPT.
• OpenAI, The Hugging Face incident and other third-party impacts from misaligned models, update of 25 September 2026: 53 user-provided images.
• EDPB, Report of the work undertaken by the ChatGPT Taskforce, 23 May 2024: single EU establishment from 15 February 2024; no shifting responsibility to users.
• GDPR, Regulation (EU) 2016/679, on EUR-Lex: Articles 4(9), 13, 15, 28 and 56.
• European Commission, Adequacy decisions: the US covered only for Data Privacy Framework participants.
• California Privacy Protection Agency, Frequently Asked Questions: the CCPA right to know the categories of third parties a business discloses to.
• FTC, AI Companies: Uphold Your Privacy and Confidentiality Commitments, 9 January 2024: liability for broken privacy commitments.

Accessed 10 November 2026.