Who owns your data in an AI tool, and who can use it

5 days ago
3 min read

Updated: 2 days ago

Introduction

Ownership is the question everybody asks and it is not quite the right one. Almost every vendor will confirm that you own your data, and that statement is compatible with a licence permitting them to use it for training, improvement, analytics and anything else described in a policy you have not read.

The question that determines your exposure is what the vendor is permitted to do, who else can see it, where it goes, and what happens to it when you leave. In a small business these are practical concerns rather than abstract ones, because the material being uploaded is customer records, quotes, contracts and internal documents that you may be contractually obliged to protect.

1. Who owns your data in an AI tool matters less than the licence you grant

Read past the ownership statement.

"You retain ownership" followed by a broad licence to use, reproduce and process for service improvement is the normal construction. The licence is the operative part.

2. Find out whether your content trains their models

The clearest single question.

Some vendors do not use business customer data for training, some do by default with an opt-out, and some require a particular plan to prevent it. This should be answered in writing before anything sensitive is uploaded.

3. Ask who else can access it

Beyond the vendor.

Subprocessors, hosting providers, support staff, and any third-party model provider behind the product. A tool that passes your content to another company's model has extended the list of parties involved.

4. Establish where it is stored and processed

Jurisdiction matters.

Which countries, and whether that creates obligations for you. Cross-border transfer of personal data is regulated in many places and the requirements are specific rather than general.

5. Check retention and deletion

Both during and after.

How long content is retained, whether it is deleted on request, and what happens on termination. Deletion from the live service and deletion from backups and logs are different, and the difference is worth knowing.

6. Consider what your own contracts require

The obligation you may already have.

Client confidentiality clauses, professional obligations and sector rules may restrict where client material can be processed, or require consent. Uploading a client document can breach an agreement you signed years ago.

7. Be particularly careful with personal data

The highest-consequence category.

Customer records, employee information, health or financial details. Processing these through a third-party service engages data protection obligations that vary by jurisdiction and that generally require a written arrangement with the processor.

8. Distinguish the free tier from the paid one

A common and expensive assumption.

Consumer and free tiers frequently have materially different data terms from business plans, including whether content is used for training. Staff using a free account for work material is a real and widespread exposure.

9. Write an internal rule about what may be uploaded

The practical control.

A short list of what is acceptable, what needs approval, and what must never be put into an external tool. People will use these products regardless, and the only question is whether they are doing so with guidance.

The legal position on data protection, confidentiality, professional secrecy and cross-border processing differs substantially by jurisdiction and by sector, and it is developing quickly. For material use, confirm the position rather than inferring it from a vendor's marketing.

Conclusion

Read the licence rather than the ownership statement, because the licence is what determines the exposure.

Get a written answer on whether your content is used for training, find out which subprocessors and model providers can access it, establish where it is stored and processed and whether that creates obligations for you, check retention and what deletion actually covers, compare all of this against your own client confidentiality commitments, take particular care with personal data, remember that free and consumer tiers have different terms from business plans, and publish an internal rule about what may be uploaded.