Free tool
Is your AI plan safe for client data?
Pick an AI tool and the plan your team uses. See whether it has a contract with your firm, whether it trains on what's typed, and whether it belongs anywhere near client data.
Checked against each provider's terms on 21 October 2026.
Maintained by Paulo De Sousa, co-founder of SimpleKPI.
Every plan, side by side
The rule of thumb: approve the business plans your firm pays for, and keep client data off personal accounts.
ChatGPT
| Plan | For client data? | Contract with your firm | Training on what's typed |
|---|---|---|---|
| Free, Go, Plus or Pro | Keep it out | No contract or data processing agreement with your firm. | May be used to train OpenAI's models unless the user turns off "Improve the model for everyone".Personal plans, controlled by each user's own settings. |
| Business (formerly Team) | Business terms | Business terms, with a data processing agreement available. | Not used for training by default.Previously called ChatGPT Team. |
| Enterprise | Business terms | Business terms, with a data processing agreement available. | Not used for training by default. |
Microsoft Copilot
| Plan | For client data? | Contract with your firm | Training on what's typed |
|---|---|---|---|
| Personal Microsoft account | Keep it out | Consumer terms. No data processing agreement with your firm. | Microsoft uses Copilot conversations for AI training unless the user opts out of training on their conversation activity. The UK isn't among the countries it excludes.This is the consumer Copilot app, even when used for work. |
| Signed in with a work account | Business terms | Enterprise data protection under Microsoft's data protection addendum. | Prompts aren't used to train the underlying models.Covers Microsoft Copilot and Copilot Chat with a Microsoft Entra ID account. Web search queries are handled under Microsoft's services agreement instead. |
Claude
| Plan | For client data? | Contract with your firm | Training on what's typed |
|---|---|---|---|
| Free, Pro or Max | Keep it out | Consumer terms. No data processing agreement with your firm. | Used for training only if the user allows it. Allowing it means chats can be kept for up to five years instead of 30 days.Each user chooses their own setting. |
| Team or Enterprise | Business terms | Anthropic's commercial terms, with a data processing agreement. | Not used for training.Also applies to Anthropic's API. |
Gemini
| Plan | For client data? | Contract with your firm | Training on what's typed |
|---|---|---|---|
| Personal Google account | Keep it out | Consumer terms. No data processing agreement with your firm. | Activity is kept by default for adults, and human reviewers may read some conversations. Reviewed conversations can be kept for up to three years.Even with activity turned off, chats are held for up to 72 hours. |
| Google Workspace (business account) | Business terms | Workspace terms with Google's Cloud Data Processing Addendum. | Not used to train models without your permission, and conversations aren't reviewed by people. |
Perplexity
| Plan | For client data? | Contract with your firm | Training on what's typed |
|---|---|---|---|
| Free, Pro or Max | Keep it out | Consumer terms. No data processing agreement with your firm. | "AI data retention" is on by default, which lets Perplexity use your data to improve its models.Switching it off doesn't remove what was collected before. |
| Enterprise Pro | Business terms | Perplexity acts as your processor under a data processing agreement. | Queries are never used for training. |
General information, not legal advice. Read more in free vs business AI plans.
Questions
About AI plans and client data.
Why does the plan matter more than the tool?
The same AI tool can come with business terms or consumer terms. Business plans give your firm a contract and a data processing agreement and don't train on what's typed by default. Personal plans have no contract with your firm, and many can use what's typed for training.
Is a business plan enough on its own?
It's the foundation, not the whole answer. You still need an AI policy, staff training, a DPIA and a way to keep unnecessary personal data out of prompts.
Can staff use a personal account for work at all?
For tasks with no personal data, such as explaining a tax rule or rewording a generic paragraph, the risk is low. Client names, contact details, financial or health information should stay off personal accounts.
How up to date is this?
We checked every entry against each provider's own terms and help pages on 21 October 2026. Providers change their plans often, so check the current terms before relying on them.
Approve the right plans. Block the rest.
Saiela shows every AI tool by plan, lets you approve business plans for client work and warns staff on personal accounts before they send.