It depends on the vendor and the plan you're on, and it can change when terms are updated. Many AI companies have different rules for consumer and business accounts. Before you connect an agent, find out in writing whether your data is used for training, whether you can turn that off, how long it's kept, and how to have it deleted.
An AI agent is often two companies: the one that sells you the agent, and the AI model provider it runs on. Your data can pass through both, and each has its own terms.
Four questions to get answered in writing:
- Training: Is our data used to train or improve your models, or your provider’s? Can we turn that off?
- Retention: How long do you keep our data, including logs?
- Deletion: How do we have it deleted, and how do we confirm it’s gone?
- Sharing: Who else receives it (subprocessors), and where are they?
If a vendor can’t answer those plainly, that’s your answer. I check these terms as part of an AI agent evaluation and an AI security audit.