By The answer depends on the product, account, settings and how information is shared. OpenAI, Anthropic and Google offer business products with no-training commitments by default or for specified uses. Consumer products have different controls and exceptions. A paid personal subscription does not necessarily give you the same protections as a business account.
Before staff put client information into any AI tool, check three things: whether the provider may use it for training, how long it is kept, and who can access it.
What each vendor says
OpenAI
OpenAI says it does not train on business inputs and outputs by default, including ChatGPT Business, Enterprise and the API. Organizations can choose to share data in certain circumstances. Its enterprise privacy page describes the products covered and the controls available.
For individual ChatGPT services, OpenAI may use content to improve models unless the user opts out. The choice can be made in Data Controls or through the privacy portal. Temporary Chats are not used to train models. Feedback can have different consequences, so check the current controls before submitting it.
Anthropic
Anthropic's consumer terms update asks Free, Pro and Max users to choose whether to allow their conversations to improve Claude. If a user permits this, Anthropic may retain data in de-identified form in training pipelines for up to five years. Its retention guidance describes what happens when a chat is deleted and the exceptions.
Anthropic distinguishes consumer services from its commercial products, including Claude for Work and the API. Check the commercial training policy and the agreement for the specific service. Feedback and other specified circumstances can be treated differently from ordinary chats.
Google says Workspace data is not used to train or improve the underlying generative AI models outside Workspace without permission. Its separate commitments for Gemini in specified Workspace apps say that content is not used to train or improve Gemini or other generative AI models and that prompts and outputs are not stored without permission. Those statements have a defined product and account scope; verify which Gemini experience and account staff actually use.
The consumer Gemini Apps Privacy Hub describes different rules. With Keep Activity on, activity can be used to improve services, including training models, and some is reviewed by people. Reviewed activity can be kept for up to three years and is not deleted when a user deletes their activity. The default auto-delete period for saved activity is 18 months.
Turning Keep Activity off prevents future chats from being used for model training unless the user submits feedback. Google says those chats are still retained for 72 hours to provide and protect the service and process feedback; human review can also occur for safety. Temporary chats have their own rules. Do not paste confidential information into a consumer tool simply because a training setting is off.
Training is one of three questions
A no-training commitment does not tell you how long data is kept or who can read it. Anthropic's consumer retention guidance illustrates the difference: deleted chats are removed from back-end storage within 30 days, while inputs and outputs flagged by automated safety systems as violating its Usage Policy can be retained for up to two years. Data associated with feedback can be kept for five years. Legal and other exceptions can also apply.
Ask the provider, and check the agreement: Is this information used to train models? How long is it kept? Who can access it, including for support, safety and feedback?
What Canadian businesses need to consider
Your privacy obligations do not move to the vendor. The applicable law depends on the organization, activity and jurisdiction, so check the rules for your circumstances.
In May 2026, Canada's Privacy Commissioner and the Quebec, Alberta and British Columbia commissioners published a joint investigation of OpenAI. They found the collection and use of personal information from public websites and licensed datasets for the models examined was overbroad and inappropriate under the applicable Acts. On the specific appropriate-purpose question concerning user interactions, the investigation found that aspect not well-founded. The report contains separate findings on consent and other obligations; it is not a blanket approval of every business use.
Alberta's PIPA has specific requirements when an organization uses a service provider outside Canada to collect personal information on its behalf, or transfers personal information to one. Review Alberta's guidance on policies, notification and a contact who can answer questions. Confirm the actual provider, processing locations, contract and applicable rules; do not assume that the provider's headquarters alone establishes where a particular service processes data.
The federal Privacy Commissioner advises businesses to limit sharing personal, sensitive or confidential information and be open about AI use and risks.
A worked example
A bookkeeping firm has six staff. Two use personal ChatGPT accounts to tidy client emails, and a third uses Gemini on a personal Google account. The firm also has a Workspace subscription with Gemini, but nobody has checked which account or settings staff use. Client names and financial details may be entering services governed by different controls, retention terms and review practices. The firm needs an inventory before it can decide what to change.
What to do this week
- List the AI tools in use, by person, including personal accounts. Record the product, account, plan and settings.
- Review the business products you already pay for and their contracts. Confirm the specific service and controls before moving work into one.
- Check consumer account training and activity controls, including feedback and temporary-chat exceptions. A setting change does not automatically remove earlier data.
- Write down what staff may and may not paste in. Client names, health information, government identifiers and payment details are a sensible starting point for restricted information.
- Review your privacy obligations and vendor processing arrangements, including any Alberta requirements for service providers outside Canada. Document the relevant purposes, locations and contact information where required.
- Set a review date. Terms and product features change.
Where Lumin fits
Lumin's AI integration work identifies source information, account owners, required permissions and data readiness before anything is connected. Permitted data is one input to tool selection.
- Workflow mapping documents inputs, manual steps, expected outputs and the staff owner for each step.
- Handover includes an operating guide, team training and a named maintenance owner.
- Prepared replies and quotes stay drafts until the agreed review is complete.
To work out which tools are handling client information, book a discovery call.