A quick look at the privacy policies for the most popular AI tools

Whether it’s for our organisation, our clients or our own personal use, it’s important to be aware of how different tools capture and share our data. Each AI platform has their own privacy policies, and as organisations working for social justice, we have an obligation to protect the privacy our data.

In this article we’ll take a brief look at the privacy policies and statements made by some of the more commonly used AI tools, including:

• ChatGPT
• Google Gemini
• Microsoft Copilot
• Claude (Anthropic)
• Perplexity
• DeepSeek
• Meta AI (Facebook, Instagram)
• xAI Grok

This information is provided as an overview and is relevant at the time of writing. Readers should do their due diligence by checking with their provider of choice for the most up-to-date information.

None of this information is to be regarded as legal advice or recommendations for one service over another, and each individual or organisation should consider their own needs and risk when deciding whether to use any of the tools listed here.

If you are looking to begin your organisation’s AI journey, be sure to join our Asia-Pacific AI Nonprofit Learning Community and check out our AI Readiness Assessment. A simple quiz will help you see where your organisation stands as to your readiness for AI.

All too overwhelming? If you’d like to dive deeper with some tailored advice, please set up a consult with our AI experts.

Information captured 30 January 2026.

Terminology explained

We’re going to mention a few things in this article that you might not have encountered before. Here’s a few definitions that might help your understanding. Additionally, if you’re looking to understand other common terms in AI, be sure to check out our AI Glossary.

Model Training

Model training is the process of teaching an AI system to recognise patterns and make predictions (for example, generating new words and sentences in large language models). This training is done by exposing it to large amounts of data (e.g. large amounts of text from the internet in the case of large language models). During training, the model adjusts its internal settings to improve its accuracy over time, much like a person learning from experience.

Understanding model training matters for not-for-profits, because the quality, diversity and representativeness of the data used during this stage directly shapes how the AI behaves. A model trained on incomplete or biased data will produce incomplete or biased results. If your organisation is evaluating an AI tool, asking how and on what data it was trained is a good starting point for assessing its suitability.

Training Data

Training data is the information used to teach an AI model how to perform a task. This can include text, images, numbers, audio or any other type of data. This has typically been done by importing large collections of data from the Internet.

For NFPs and nonprofits, it's worth asking where an AI system’s training data came from, whether it includes diverse perspectives and whether consent was obtained for its use. Training data that is narrow, outdated or unrepresentative can lead to outputs that don't reflect the communities you serve.

Deciding to share your data with AI tools

When deciding what information to share with AI tools, it is important to consider the privacy and sensitivity of any data being shared. There are specific regulatory requirements about managing and sharing any sensitive or personal data (Personally Identifiable Information or PII) depending on your jurisdiction.

There may be ways to achieve the outcome you need without sharing the personal data, for example data can be anonymised, removing the personally identifiable information before it’s shared with the tool.

To understand your organisations procurement journey better, read our Not-for-profit guide to AI procurement and take the quick procurement quiz to discover your organisation’s pathway.

Now that we’re equipped with that knowledge, let’s have a quick look at the different privacy policies from some of the more common names in the world of artificial intelligence!

ChatGPT

Explore OpenAI's Privacy Portal

The OpenAI Privacy Portal is a central hub for users to manage their personal data, specifically for consumer services like ChatGPT Plus and Sora. It provides ways for users to request data downloads, account deletions or to "opt-out" of having their conversations used to train future models.

It also includes a specialised request form to remove personal information if it appears in ChatGPT's responses.

Google Gemini

Explore Google's Gemini Apps Privacy Hub

Google’s privacy framework for Gemini emphasises integration with the broader Google ecosystem while providing granular controls through the Gemini Apps Privacy Hub. Google stores Gemini activity for 18 months by default, but users can toggle this to 3 or 36 months (or users can turn off activity saving entirely). Notably, even when activity saving is off, Google retains conversations for up to 72 hours to provide required functionality to its service.

Microsoft Copilot

Explore Data, Privacy, and Security for Microsoft 365 Copilot

The Microsoft 365 Copilot privacy page focuses on enterprise-grade security. It guarantees that prompts and responses for business users are not used to train the underlying Large Language Models (LLMs). The system is built to honour the same data residency and compliance standards (like GDPR and HIPAA) that apply to the rest of the Microsoft 365 suite, ensuring that data stays within the organisation's tenancy.

Claude (Anthropic)

Explore Anthropic's Privacy Center

Anthropic’s Privacy Center highlights their "Constitutional AI" approach, which prioritises safety and data minimisation. Their policy clarifies that for individual users, data is retained in order to provision its service and to improve its models, unless a user opts out. For Enterprise users, data is not used for model training by default. Anthropic privacy policy also details their "retention windows," where data is generally deleted within 30 days, unless required for legal or safety reasons.

Perplexity

Explore Perplexity's Legal Hub

Perplexity’s Privacy Policy outlines how the platform collects "Service Interaction Information," which includes the prompts you submit and the pages, or collections, you generate. While they use this data to facilitate their service and improve their AI models, they offer a clear "opt-out" toggle in the settings menu to prevent your search interactions from being used for model training. The policy also notes that if you sync your Google or Microsoft email/calendar accounts, that specific data is used only for service delivery and is explicitly excluded from being used to train or fine-tune their AI models.

DeepSeek

Explore DeepSeek's privacy policy

DeepSeek’s policy outlines how it collects account details, user inputs, and technical logs, primarily storing and processing data on servers located in the People's Republic of China. It emphasises that while they use data to improve their models, they do not engage in "profiling" or automated decision-making that has legal consequences for the user. They also provide a method to opt-out of using your data for model training.

Meta AI (Facebook, Instagram)

Explore Meta's Privacy Policy

Meta’s Privacy Policy covers AI across its entire suite (Facebook, Instagram, WhatsApp). It explains that Meta uses the information people share on its products (such as posts, photos and captions) to train its generative AI models. While they offer a "Right to Object" form for users in certain regions (like the EU), the policy generally allows for broad use of public content for AI development. Meta data is primarily stored in the US. You can see some behind the scenes of what these data centres look like here.

Also worth mentioning that Meta has faced some legal challenges regarding privacy-related violations: FTC’s $5 billion Facebook settlement.

xAI (Grok, X, formerly Twitter)

Explore xAI's Privacy Policy

The xAI Privacy Policy for Grok details a close relationship with the X platform. It states that Grok uses public posts from X to provide real-time information and for model training. Users can choose a "Private Chat" mode where conversations are not saved to their history and are typically deleted from xAI systems within 30 days.

xAI’s data centres are all located in the US. (Source)

Taking control of our privacy

Each system has their own approach to privacy and data use, and it’s somewhat within our control how we choose to use our data.

What are your thoughts about the state of data privacy in a world of AI? Join the discussions in our AI Community forums!