Answer in two parts: what you do with customer data, and what your model provider does under your agreement. Give specific statements you can prove, name the retention periods, and say plainly what you cannot control. A short true answer beats a confident broad one that a buyer later finds is wrong.
Why the question is harder than it looks
"Do you train on our data" can mean four different things.
- Do you train your own models on customer inputs?
- Do you fine-tune a model for each customer or for all customers?
- Does the model provider you call train on the data you send?
- Do you use customer data to evaluate or improve prompts?
Each has its own answer. A single yes or no hides this and can be wrong in a way that matters.
Find the facts before you write
Check each layer.
Your product. Do any pipelines copy prompts into datasets? Do engineers export conversations to evaluate quality? Does a vector database hold customer content that is shared across tenants?
Your provider. Read the data terms for the API plan you actually use. As one example, one major provider's documentation states that data sent to its API is not used to train or improve its models unless the customer explicitly opts in, and that abuse monitoring logs are kept for up to 30 days by default. Those statements are specific to that provider and plan. Quote the current terms for yours and keep the link.
Your tools. Error trackers, analytics and support tools may receive prompt text and have their own policies.
A structure for the answer
- Our models. "We do not train or fine-tune models on customer content." Only if true, and say where the boundary is, such as "except where a customer opts in for a named feature."
- Our provider. "Our model provider processes prompts to return responses. Under our agreement it does not use API data for training. It retains prompts for up to N days for abuse monitoring, or zero with the retention option, as described in its terms." Fill in the real values.
- Our own storage. "We store conversation history for N days for product features. Logs are redacted and kept for N days."
- Controls. "Customers can request deletion. Staff access to content is restricted and logged."
- Changes. "We notify customers of sub-processor changes, see our list."
Avoid these phrases
- "Your data is never stored." It is stored somewhere, at least briefly.
- "Fully private" or "never leaves your environment" unless you run the model in the customer's environment.
- Certifications you do not hold. Say what you have and what is in progress.
See answering security questionnaires truthfully for general wording rules, and zero data retention: what to ask.
Keep one source of truth
Write the answer once, with owner and review date, and reuse it. Re-check it each time you change a provider, add a sub-processor or turn on a new feature. Stale answers are how inaccurate claims reach customers.
Quick check
What if the provider's terms change after I answer?
Your answer is a statement as of its date. Date it, review it on a schedule, and update customers if the change affects what you told them.
Sources
Last reviewed: 19 October 2026.
