What You Paste into Free ChatGPT or Claude: Where Your Data and Your Clients' Data Go
By Anis Hammouche·October 31, 2026
When you paste text into the free version of ChatGPT or Claude, that text is sent to the provider's servers. What happens to it depends on two settings in your account, on how long the provider keeps it, and on what the text contains. A draft article has nothing in common with a client file containing names, amounts and contracts. As long as you only paste generic material, the risk stays low. As soon as a piece of data identifies a person or a client, you need a framework before you send anything.
What actually leaves your computer
An AI tool in a browser works like a messaging app: what you write is sent to a server, processed, then stored. The storage does not necessarily stop when you close the window. It depends on the history you keep, on whether you delete the conversation, and on the settings that allow or forbid using your exchanges to improve the service.
Three points to keep in mind. The text leaves your computer. It stays with the provider for a period that differs depending on the settings. And using it for training is an option you must check in your account, not a guarantee you accepted once and for all.
What the official pages say
Terms change. The table reflects what Anthropic and OpenAI's pages say at the time of writing. Check them in your account before relying on them.
| Topic | Claude (Free, Pro, Max) | ChatGPT (consumer setting) |
|---|---|---|
| Use for training models | Only if you allow it in the privacy settings | A setting lets you turn off the use of conversations to improve models (OpenAI help) |
| Retention if you allow training | Up to five years, in de-identified form, for new or resumed conversations | As stated in the conditions shown in the setting |
| Retention if you refuse | No day count on the page, but your chats are not used for future training | Not detailed here: see the OpenAI help page |
| Deleted conversation | Not used for future training, and erased from storage within thirty days | Not detailed here: see the OpenAI help page |
| Professional offers | Team, Enterprise and API are not covered by these consumer rules | Business offers governed by their own terms |
Sources: Anthropic's announcement of the consumer terms and Claude's data retention page. For ChatGPT, the data controls setting is described in the OpenAI help article on data controls. The exact retention periods on the OpenAI side are on that page.
The most important setting fits in one line: on a consumer account, you can refuse the use of your exchanges for training. That refusal applies to the future only. Anthropic specifies that data already included in training runs in progress remains there.
What you paste, and what you do not
For a freelancer, the question is not "should I use AI?" but "what material am I entrusting to it?" The table below is a reading grid to consult before each paste.
| Level | Examples | Rule |
|---|---|---|
| No particular risk | An article outline, a list of ideas, a translation of a public text, a generic training plan | You can paste freely |
| Caution | A client brief, a commercial offer, a specification | Replace names, addresses, amounts and identifiers with placeholders before pasting |
| Never paste | Identifiable client personal data, health data, passwords, API keys, confidential contracts without agreement | Do not paste, even half-anonymised |
The most common trap is pasting context. A client email forwarded "so they can rephrase it", a screenshot of a spreadsheet, a database export "to check an error". In each case, third-party data leaves with the rest of the text. Proper anonymisation means replacing names, addresses, numbers and amounts with neutral placeholders. Then you review the final text before sending it.
What the CNIL and the GDPR say
The CNIL recommends defining the authorised and forbidden uses of a generative AI tool, and keeping personal data out of prompts (CNIL, questions and answers on using a generative AI system). These guidelines are aimed mainly at organisations, but they also apply to a freelancer who processes their clients' data.
If you process client data as part of a service, GDPR obligations may apply to you, depending on your role and your contract. This text does not replace legal advice. For your specific case, consult the CNIL and the resources on service-public.fr, or a legal professional.
Settings to change today
- Open the privacy settings of each tool you use, and turn off the use of conversations for training if you do not want to share them.
- Delete the history of conversations containing client data, knowing that deletion does not wipe everything immediately.
- Write a one-page rule: what you paste, what you do not paste, who approves exceptions. Five lines are enough.
- For client data, compare a professional offer by reading its data processing agreement before you pay, and do not assume it is automatically compliant.
Frequently asked questions
Is the free version less safe than the paid one? Not necessarily on content, but the terms differ. Professional offers are governed by other contracts. It is the contract, not the price, that determines what is done with your data.
If I delete a conversation, does the data disappear? It disappears from your history, but not necessarily from the provider's systems straight away. The timelines depend on the provider's retention policy, described on its official page.
Can I paste a document if I half-anonymise it? No. Partial anonymisation often leaves enough clues to identify a person or a company, especially in a small market. Replace everything that identifies, or do not paste it.
How does this differ from the article on what you should never hand to an AI? This one follows the path of what you paste: where it goes at the provider, what the official pages say, which settings to change. The other lists the three families of information to keep out of the tool, with a grid by task (invoice, reminder, legal question, unhappy client). Read what you should never hand to a public AI for that grid.
Stuck on a specific case? Write to me via the contact page.
