By Interlaced
Your team is using AI. You know it, even if you can’t see it. ChatGPT for writing. Claude for research. Gemini in the inbox. Notion AI summarizing meeting notes. A Slack integration someone added last Tuesday.
Here’s the question most founders never ask: Where does all of that data actually go?
Not in a paranoid way. In a “we have customer contracts, internal financials, and confidential hiring plans floating around in these prompts” way. Because the answer is not the same for every tool — and the default settings are almost never what you’d choose if you read them carefully.
Do You Know Which Tier Your Team Is Actually On?
This is the most common and most expensive mistake we see.
There’s a meaningful difference between the consumer version of an AI tool and the business version — and it’s not just the price. Consumer and individual paid tiers of the major AI tools default to using your conversations to train their models. Most people never change that setting, because most people don’t know it exists.
Business and enterprise tiers are a different story. They contractually exclude your data from training, offer encryption, and in most cases come with a Data Processing Agreement (DPA) — the legal document that actually matters if you’re handling customer data.
The dangerous middle: a team of 15 people, all on individual paid subscriptions, pasting in customer proposals, pricing strategy, and board materials. Nobody has checked a privacy setting. Nobody knows what’s being retained or for how long.
Quick test: Go ask three people on your team which version of ChatGPT they use. If the answer is “the paid one,” that’s not enough information.
“Pro” Is Not the Same as “Business”
This trips people up constantly, because it feels like paying for a premium tier means you’re covered. You’re not.
ChatGPT Plus, Claude Pro, Gemini Advanced — these are individual paid plans. They come with better features, but their data handling defaults are closer to the free tier than to the enterprise tier. You still need to manually opt out of model training in settings. Most people don’t.
The plans that actually protect your data by default are the business and enterprise versions: ChatGPT Business, Claude for Work, Gemini for Google Workspace. These exclude your data from training automatically, don’t require you to hunt through a settings menu, and come with the contractual protections that matter when a customer or investor asks about your data practices.
Ask yourself: If someone on your team is pasting a customer’s information into an AI tool right now, which version are they using? Do you actually know?
What “Training on Your Data” Actually Means
It means the text you type — the prompt, the document you paste in, the draft you’re editing — can be used to improve the model for everyone else. Your specific words probably aren’t being served back to a competitor verbatim. But your data is being used, and it’s being retained, sometimes for longer than you’d expect.
Consumer tiers at major providers have retention windows that can stretch to years for users who stay opted in. Even when you opt out of training, data is often held for some period for safety and abuse monitoring. The specifics vary by provider and change as policies update — which is exactly why the contract matters more than the marketing page.
A DPA locks the vendor to specific commitments in writing. Without one, you’re relying on a privacy policy that can be updated without notice.
What to Actually Do About It
You don’t need to ban AI tools. That ship has sailed, and banning things your team finds genuinely useful just pushes the behavior underground.
What you do need:
- Audit the tiers your team is actually on. Pull the subscriptions. Anything that touches company or customer data should be on a business or enterprise plan, not an individual one.
- Get a DPA in place with your key AI vendors. If you’re on a business tier, this is usually standard. If you’re not sure whether you have one, you don’t.
- Set a simple rule for what data can go into AI tools. Public information and internal drafts are usually fine. Customer data, financials, and confidential legal or HR materials need a clear policy before someone makes an expensive mistake.
- Make this part of onboarding. Every new hire should know which AI tools are approved, which tier they’re on, and what data classifications are off-limits. It takes ten minutes to explain and saves a lot of cleanup later.
Why This Matters More as You Grow
At five people, a data misstep in an AI tool is a problem. At fifty people, with ten different AI tools running across five teams, it’s a liability.
The startups that handle this well aren’t the ones with the most restrictive AI policies. They’re the ones that got ahead of it early — standardized the tools, moved to the right tiers, and set clear expectations before the stack got complicated.
That’s a lot easier to do at 20 people than at 200.
Interlaced helps startups build practical AI policies and close the gaps before they become problems. Schedule a Tech Strategy Session to see where your team’s exposure is.