Large Language Models

✓ Privacy Positives

• •Conversations not used to train models by default (API)
• •Users can opt out of training data use on Claude.ai
• •Data deletion requests honoured per privacy policy
• •No sale of personal data stated in privacy policy
• •SOC 2 Type II certified infrastructure

✗ Privacy Concerns

• •Claude.ai conversations may be used for training unless opted out
• •Conversation data retained for up to 90 days by default
• •Third-party service providers may process data

✓ Privacy Positives

• •Enterprise customers: prompts and responses not used to train foundation models
• •Microsoft 365 Copilot data stays within Microsoft 365 compliance boundary
• •Supports EU Data Boundary for European customers
• •ISO 27001, SOC 1 & 2 certified
• •Data subject rights (access, deletion, portability) supported

✗ Privacy Concerns

• •Consumer Copilot (Bing) conversations may inform model improvements
• •Microsoft collects usage and diagnostic data by default
• •Data may be shared with Microsoft affiliates and partners
• •Advertising personalisation applies in consumer tier

✓ Privacy Positives

• •Chat history can be turned off to prevent training use
• •Users can request deletion of their data
• •API data not used for training by default
• •SOC 2 Type II and ISO 27001 certified
• •Memory feature can be disabled or cleared by user

✗ Privacy Concerns

• •Free-tier conversations used for model training unless opted out
• •Broad data collection including device info, usage patterns, and location
• •Data shared with third-party vendors and service providers
• •Conversation data retained for up to 30 days even after deletion request for safety review
• •No end-to-end encryption for conversations at rest

✓ Privacy Positives

• •Gemini Apps Activity can be turned off in Google Account settings
• •Users can delete Gemini conversation history
• •Workspace (enterprise) data not used to train models
• •Google security infrastructure and encryption in transit
• •Data subject rights supported under GDPR and CCPA

✗ Privacy Concerns

• •Conversations reviewed by human reviewers to improve products (stated in policy)
• •Data linked to Google Account and integrated with broader Google data profile
• •Conversations retained for up to 18 months by default
• •Used to personalise Google ads unless opted out
• •Broad data sharing within Google product ecosystem

✓ Privacy Positives

• •Users can request data deletion via X privacy settings
• •Grok conversations can be deleted from history
• •xAI privacy policy published and accessible

✗ Privacy Concerns

• •Conversations used to train xAI models by default; opt-out buried in settings
• •X platform posts (public and private) used as training data per X privacy policy
• •Data shared between xAI and X Corp with limited separation
• •Limited independent security audit disclosures
• •Privacy policy less detailed than competitors on data retention periods
• •No enterprise-grade data isolation tier available at time of review

✓ Privacy Positives

• •Privacy policy published and accessible in English
• •Users can request account deletion

✗ Privacy Concerns

• •Data stored on servers in the People's Republic of China, subject to Chinese data laws
• •Chinese National Intelligence Law may compel data disclosure to authorities
• •Broad data collection including keystroke patterns and device fingerprinting (per published policy)
• •Conversation data used to train models; no opt-out mechanism described
• •Data shared with third parties including advertising partners
• •No independent third-party security audits disclosed
• •Banned or restricted for government and sensitive use in multiple countries
• •No EU data residency or adequacy decision coverage