# Privacy & data handling

> Privacy and data handling is deciding what enters a prompt, what the provider stores, and what should never be sent.

What you send, what is stored, and what should never enter a prompt.

Track: Ship & Maintain
Access: free
Card: https://buildsparkai.com/privacy-data
Plain text: https://buildsparkai.com/privacy-data.md
Last checked: 2026-10-18

## What it is

What you send and what is stored are different questions, and the answers depend on the product and the agreement. OpenAI's data controls page says that, as of March 1, 2023, data sent to the OpenAI API is not used to train or improve OpenAI models unless you explicitly opt in. The same page says abuse-monitoring logs may contain prompts and responses and are retained for up to 30 days by default, unless the law or harm prevention requires longer. Those 30 days are vendor-reported. Zero Data Retention is a separate control that needs approval, and some endpoints still store application state when it is on. Anthropic's API data-retention page says prompts and outputs are not retained by default, with an exception for Covered Models, which require 30-day retention, and that retained data is not used for model training without express permission. If a chat is flagged, Anthropic says it may keep inputs and outputs for up to 2 years. Those periods are vendor-reported. On Amazon Bedrock and Google Cloud's Agent Platform, Anthropic says the cloud provider is the data processor. Read the page for the product you call.

## Why it matters

**Cost.** Leaving an email address out does not change the token rate. It removes those tokens from the prompt. This card does not add a price.

**Quality.** A prompt that includes an account number can sound more specific, and it can also put that number into a log. Ask whether this question needs the field.

**Risk.** A line that says prompts are not used for training is not the same as a line that says nothing is stored. OpenAI and Anthropic both describe retention for safety review and, on some features, so the product can work. Zero-retention arrangements have exceptions those pages list.

## Try today

Take one real prompt. Mark anything you would not paste into a shared document: names, emails, account numbers, health details. Delete what the question does not need. Write down which provider page you checked for retention, and the date.

## Common mistake

Pasting a full customer record because the model might find it useful. Send the field the question needs.

## Self-check

Does "not used for training" mean the provider keeps nothing?

No. Both vendors describe cases where prompts or logs are still retained

## Practice and deep

Coming soon. One real prompt with identifiers marked, the ones the question needs kept, and the provider page you checked named.

Coming soon. How OpenAI separates abuse-monitoring logs from application state, and how Anthropic separates default retention, Covered Models, and a flagged chat.

## Sources

- [OpenAI, Data controls in the OpenAI platform](https://developers.openai.com/api/docs/guides/your-data)
- [Anthropic, API and data retention](https://platform.claude.com/docs/en/manage-claude/api-and-data-retention)

Opened 2026-10-18. Vendor, framework, or standards docs. This card does not add a rate, a usage count, or a score of its own. Numbers quoted from a source are labelled vendor-reported or as that document's own words. The 30-day and 2-year periods are vendor-reported on the pages linked here, and they depend on the product and the agreement.