Is ChatGPT private? What happens to what you type

OpenAI runs two sets of terms. Its services for individuals are covered by its consumer privacy policy, and its business products by its enterprise privacy commitments. The account you sign in with decides which applies, whatever you use it for, so a lawyer doing client work on a personal Plus account is on consumer terms.

Most of the attention goes to training, and access matters as much. For ChatGPT Business, OpenAI states that its access to stored conversations is limited to authorised employees who need it for engineering support, investigating potential abuse and legal compliance, and to specialised third-party contractors bound by confidentiality who review for abuse and misuse. On ChatGPT Enterprise, Edu and Healthcare, OpenAI says authorised employees will only access conversations to resolve incidents, to recover a user's conversations with the organisation's explicit permission, or where the law requires it. Business data may also be run through automated content classifiers.

Inside your own organisation, workspace admins on ChatGPT Business can view, export and delete the conversations of users in the workspace. That is usually what a firm wants, and it also means a conversation is visible to more people than the person who typed it.

On ChatGPT Enterprise, Edu and Healthcare, workspace admins set how long data is kept, and OpenAI says deleted conversations are removed from its systems within 30 days unless it is legally required to keep them. OpenAI does not list retention control among its commitments for ChatGPT Business.

The legal exception has been used. In 2025 a US court ordered OpenAI to preserve ChatGPT and API conversations it would otherwise have deleted, as part of the New York Times copyright case, and the duty to keep preserving new conversations ended in October 2025. Deletion commitments carry exceptions for legal obligations, and any provider can be ordered to keep data.

The Solicitors Regulation Authority published a warning notice on the misuse of AI on 17 August 2026. It says free and paid AI tools can both put client confidentiality at risk, because, depending on the provider's terms and settings, information entered "may be stored, retained or used to improve the tool". It points to an Upper Tribunal decision, UK v SSHD [2026] UKUT 81 (IAC), which found that putting client letters into an open AI tool such as ChatGPT places them in the public domain, and it warns that legal professional privilege may be lost permanently as a result.

The notice is addressed to solicitors and SRA-regulated firms. Its reasoning applies to any organisation holding information under a duty of confidence: the provider's terms decide what happens to that information, whatever the person typing intended.

If a team is going to use ChatGPT with information that matters, answer these in writing first. The answers differ by plan and change over time, so record the date you checked them.

For drafting, summarising public material and general questions, a business ChatGPT plan with training off is a reasonable choice for many organisations. The case changes when the job is answering questions across documents you hold under a duty of confidence, such as matter files, client contracts, policies and case records. Then what matters is where those documents go, who can retrieve them, and whether each answer can be checked against its source.

Marella is built for that second job. It answers questions over a corpus built from your own documents, cites the exact passage behind each answer, and fact-checks answers against their sources, flagging inaccurate citations and unsupported claims. Managed, customer-cloud and self-hosted options are scoped per organisation, and the data path is agreed before any representative material is shared.