ChatGPT privacy policy explained in plain English

OpenAI's privacy policy says that ChatGPT keeps your account details, everything you type and upload, and technical data about your device. It may use your chats to train its models unless you switch that off. It shares data with its vendors, its affiliates and, when the law requires it, with authorities. A deleted chat is removed within 30 days, with exceptions. Below is the policy section by section as of October 2026, and what it means if you work with client documents.

Three versions, and which one applies to you

OpenAI publishes its privacy policy in three versions. The sections are almost the same; the differences are in ads, legal bases and data transfers.

The company named in the last column is the "controller": it decides how your data is used and answers for it under data protection law. Users in South Korea also have a separate addendum.

All three versions open with the same line about what they do not cover: "This Privacy Policy does not apply to content that we process on behalf of customers of our business offerings, such as our API."

What OpenAI collects

The policy splits the data into what you give, what it records while you use the service, and what it gets from others.

• Account information: name, contact details, password, date of birth, payment information and transaction history.
• User content: "your prompts and other content you upload", including files, images, audio and video, and data from services you connect to ChatGPT.
• Communication information: what you write to OpenAI by email or on social media.
• Contacts, if you choose to connect your phone's address book.
• Log, usage and device data: IP address, browser, time of each request, features you use, device type and identifiers.
• Location: the general area, worked out from your IP address. Precise GPS location only if you choose to share it.
• Cookies and similar technologies, listed among the data types in the Europe version and described in a separate cookie policy.
• Data from others: security partners, marketing vendors and public information on the internet used to build the models.

The US and Europe versions add one more item: for Free and Go users, OpenAI collects "ads history and interests" and may receive information from advertisers, for example "about purchases you make". The rest-of-world version, last updated in February, does not mention ads.

What it uses the data for

The list is what you would expect: to run the service, improve it, personalize it, write to you, prevent fraud and comply with the law. One of them is model training: "we may use Content you provide us to improve our Services, for example to train the models that power ChatGPT."

On personal plans, training is on until you switch it off. The policy links to OpenAI's instructions for opting out, and our guide to AI data settings shows where the switch is. Temporary Chats are not used for training either.

The Europe version also lists the legal basis for each purpose. Training rests on OpenAI's "legitimate interests and those of third parties and broader society", not on your consent. Personalized ads for Free and Go users rest on consent. The difference matters: under the GDPR you can object to processing based on legitimate interests.

In the US version, OpenAI says it does not "sell" personal data, but it may share limited data with marketing partners to advertise OpenAI on other websites. You can opt out with the marketing privacy control in settings or with Global Privacy Control in your browser.

Who it shares data with

• Vendors and service providers: hosting, cloud, customer support, payments, analytics, age and identity checks, search and shopping providers. They may use the data "only in the course of performing their duties" to OpenAI.
• Affiliates: other companies in the OpenAI group.
• Business transfers: buyers or successors in a merger, reorganization or bankruptcy.
• Government authorities and other third parties: to comply with the law, to protect OpenAI's rights, or if OpenAI determines "in our sole discretion" that terms or the law were violated.
• Business account administrators: if you join a company workspace, its admins "may access and control your OpenAI account, including being able to access your Content".
• Parents or guardians of teens who link accounts.
• Other users and third parties you share with: a shared chat link, or information you pass to search and shopping partners, whose own policies then apply.

Shared links are the one item on this list you control directly. Our article on ChatGPT data leaks covers what happened when shared chats became searchable.

How long it keeps data

There is no single period. The policy gives three cases:

• Kept until you delete it: chats, memories, the account. After you delete, OpenAI says it "will remove it from our systems within 30 days".
• Deleted automatically: Temporary Chats, within 30 days.
• Kept longer: when the law requires it (the example given is "a lawful subpoena"), for fraud and abuse, after a ban, for payment records, and the record of your own deletion request.

There is one exception to deletion. Content that "has already been de-identified and disassociated from your account" for model training is not removed when you delete the chat. Switching training off affects future chats, not ones already used.

Your rights and how to use them

Every version lists the right to access your data, correct it, delete it, restrict its use, take a copy to another service, and withdraw consent. The Europe version adds two rights to object: to direct marketing, and to processing based on legitimate interests. The US version lists the rights that some state laws give, including the right to appeal a refused request.

How to use them:

• In ChatGPT's settings: export your data, delete chats, or delete the whole account.
• Through the privacy portal or by email to dsar@openai.com, for anything the settings do not cover.
• The data protection officer: dpo@openai.com.
• A complaint to a regulator: in the EEA, the Irish Data Protection Commission as lead authority or your own national authority; in the UK, the Information Commissioner's Office; in Switzerland, the Federal Data Protection and Information Commissioner.

The policy also covers wrong answers about you. ChatGPT may produce false facts about a real person; you can ask for a correction or removal, and OpenAI will consider it "based on applicable law and the technical capabilities of our models". That is not a promise to fix it.

Children and international transfers

ChatGPT is not meant for children under 13. Users under 18 need a parent's or guardian's permission, and teens can link their accounts to a parent's.

Data is processed in the United States and wherever OpenAI's affiliates and vendors are. For users in Europe, the policy says transfers rely on the European Commission's adequacy decisions, the UK's adequacy regulations, and the Standard Contractual Clauses with the UK addendum. The other two versions say only that OpenAI uses "legally valid transfer mechanisms".

The security section is short and ends with advice worth quoting: "you should take special care in deciding what information you provide to the Services."

The whole policy in one table

What this means for professional documents

The policy is written about you, the account holder. Apart from address-book contacts, it has no separate section for people who only appear in what you paste. If you paste a client's contract into a personal ChatGPT account, the client's name and details become your "Content": stored, covered by your training setting, and subject to the same sharing and retention rules as your own words. The client has no setting of their own.

Business plans work differently. The OpenAI Services Agreement applies to the API, ChatGPT Business and ChatGPT Enterprise, and "does not apply to OpenAI services used by consumers or individuals". The Data Processing Addendum attached to it says "OpenAI acts as a Data Processor on the Customer's behalf": your firm decides, OpenAI processes. Customers in the EEA or Switzerland sign it with OpenAI Ireland. On its enterprise privacy page, OpenAI says it does not train on business data by default.

A business plan changes who decides about the data. It does not keep the data on your computer: chats are still stored by OpenAI, and workspace admins can read them. Whether your firm may use ChatGPT for client files at all, on any plan, is a question for your data protection officer or a lawyer who knows your professional rules. Our article on uploading documents to ChatGPT covers storage and access on each plan.

The method that works on any plan is to send less. Replace names, addresses, account and ID numbers with placeholders before the text leaves your computer, and put the real names back into the answer afterwards. Then what OpenAI stores under its policy is a document about Person_1 and Company_1.

Frequently asked questions

Does OpenAI read my ChatGPT conversations?

The policy says OpenAI monitors content to prevent fraud, abuse and misuse, and that vendors such as support and safety services may process it. It does not promise that no person will ever see a chat.

Does a paid Plus or Pro plan fall under a different policy?

No. Plus and Pro are personal plans and follow the same privacy policy as the free plan. The separate business terms cover ChatGPT Business, ChatGPT Enterprise and the API.

Can I ask OpenAI to delete everything about me?

You can delete your account in settings or send a request through the privacy portal. OpenAI may still keep data it needs for legal, safety or payment reasons, and content already de-identified for training.

Is ChatGPT GDPR compliant?

The policy describes how OpenAI applies the GDPR to its own processing. Whether your use of ChatGPT with clients' personal data complies is a separate question, and it depends on your plan, your contract and your own obligations.

ClientSafe replaces client names, addresses, phone numbers, account and ID numbers with placeholders on your PC, so the copy you paste into ChatGPT carries placeholders instead of names, and puts the real names back into the answer. Detection is not perfect, so review what it found before you copy.