AI Privacy Settings for Work: What to Check in ChatGPT, Claude, Copilot, and Gemini

We do security awareness sessions for businesses across Colorado. One of the topics that consistently catches people off guard is what happens to the conversations they have with AI tools like ChatGPT, Claude, Copilot, and Gemini.

Most people assume that if they are paying for a subscription, their conversations are private. That assumption is wrong. Every major AI chatbot has privacy settings worth checking, and the whole process takes about five minutes per tool.

This article walks through the key settings, what the defaults actually do, and where the limits are.

The four controls worth checking

Across ChatGPT, Claude, Copilot, and Gemini, the privacy settings break down into four categories. Not every platform uses the same labels, but the concepts are consistent:

1. Training opt-out. Whether your conversations can be used to improve the AI model. This is the most important toggle to find.
2. Memory and personalization. Whether the tool remembers details from past conversations and uses them in future ones.
3. Temporary or private mode. A per-conversation option that prevents that specific chat from being saved or used for training.
4. Export and delete. The ability to download your conversation history and delete stored data from the platform.

If you only have time for one thing, find the training opt-out. That is the setting with the most impact on where your data ends up.

What happens by default

On personal accounts (both free and paid), most AI platforms default to training ON. That means the conversations you have may be reviewed by the platform and used to improve future versions of the model.

The assumption that "I pay for it, so it must be private" comes up in almost every seminar we run. Paid personal plans typically give you more features (faster responses, longer context, access to newer models) but they do not change the default privacy posture. You still have to go into settings and turn things off yourself.

Platform-by-platform: what to look for

ChatGPT (OpenAI)

The most important setting is labeled "Improve the model for everyone." It is found under Settings and then Data Controls. Turn it OFF. This prevents your conversations from being used to train future models.

ChatGPT also has a memory feature that stores details you share across conversations. If you are using a personal account for work, consider turning saved memories OFF as well. For sensitive one-off questions, use Temporary Chat mode, which does not save the conversation or use it for training.

Claude (Anthropic)

Look for the toggle labeled "Help improve Claude" in your privacy settings. Turn it OFF to opt out of having your conversations used for training.

Claude offers an Incognito-style mode for individual conversations when you want an extra layer of privacy. One detail worth noting: Anthropic updated its privacy policy in September 2025. If you set up your account before that date, your settings may not reflect the current defaults. It is worth checking regardless of when you signed up.

Microsoft Copilot

Copilot has TWO separate training toggles, and both need to be turned OFF. One covers conversation data and the other covers voice data. Missing one of them leaves a gap. Both are found in the privacy settings.

Copilot also has personalization and memory features that store context from past conversations. Turn those OFF if you are using a personal account for anything work-related.

Google Gemini

In Gemini, the key setting is "Gemini Apps Activity" (similar to how Google handles search and location history). Turn it OFF to prevent your conversations from being saved and used for training.

Gemini also has personal context and past-chats features that carry information across sessions. Turn those OFF as well. For sensitive questions, Gemini offers a Temporary Chat option that keeps the conversation out of your stored history.

What should never go into a personal AI chatbot

Even with the right settings turned off, there are categories of information that do not belong in a personal AI account. These include:

• Client or patient names tied to private details
• Social Security numbers, passport numbers, or driver’s license numbers
• Bank account or credit card numbers
• Passwords, MFA codes, or security credentials
• Medical records or protected health information
• Legal case files or attorney-client privileged material
• Internal confidential documents (financial reports, strategic plans, trade secrets)

A safer approach when you need AI help with sensitive work: strip out the identifying details and use placeholders. Instead of "Draft a letter to John Smith at 123 Main St about his account balance of $47,000," try "Draft a letter to [Client Name] at [Address] about their account balance of [Amount]." The AI does not need real data to give you a useful draft.

The honest limit

Changing these settings is a good idea. But it is important to understand what it does and does not do.

When you turn off training and memory, you are telling the platform to stop saving your conversations and stop using them to make the AI smarter. That is real progress. It means your chats are less likely to end up somewhere you did not expect.

But here is the part most people miss: a personal AI account (even a paid one) is still a consumer product. The company behind it makes promises to you through a standard terms-of-service page, the same kind of agreement you click through when you sign up for any app. There is no contract between the AI company and your employer. There is no formal commitment about how your data is stored, who can see it, or how long it is kept.

That matters if you work in a regulated field. In healthcare, for example, companies that handle patient data need a signed agreement called a BAA (Business Associate Agreement) with every vendor that touches that data. Personal AI accounts do not come with a BAA. Same idea applies in financial services and legal work, where there are specific rules about how client information has to be handled.

The bottom line: for everyday work tasks (drafting an email, brainstorming ideas, summarizing a report that is not confidential), a personal account with the right settings turned off is a reasonable tool. For anything involving patient records, financial data, legal case files, or other regulated information, you need a business-tier AI account where your organization has a formal agreement with the platform.

What we see in our seminars

We run security awareness training for organizations across the Front Range, and the AI privacy topic has become one of the most eye-opening segments. A few patterns come up consistently.

Most people have never opened the settings page in their AI tools. The paid-plan misconception (thinking a subscription equals privacy) is the most common one we encounter. People working in healthcare and financial services are using these tools daily without realizing what the defaults allow.

We walk participants through the settings live during the session. The reaction is always the same: a mix of surprise and "why didn't anyone tell me this sooner." It takes five minutes per tool, and once people see where the toggles are, they handle it on the spot.

Colorado has a high concentration of medical practices, financial advisors, and legal firms along the Front Range, many of them with staff already using personal AI accounts for day-to-day work. The exposure is real and the fix is straightforward. It just requires someone pointing it out.

When to re-check your settings

AI platforms update their privacy policies and interfaces regularly. A setting you turned off six months ago may have been renamed, moved, or reset after a terms-of-service update. We recommend re-checking on a simple schedule:

• Every six months as a routine check
• The same day you see a policy change notification from any AI platform
• Within a week of any major platform update or new feature rollout

Put it on the calendar. It takes less time than the original setup.