Recommended Free Tools
Before sending sensitive, regulated, personal, or proprietary information to an AI service, identify the exact product, plan, account type, and contract that govern it. Then check what happens to each type of data, how long it is kept, which features the commitments cover, and what remedies the provider promises if the service fails. A public privacy or security page can explain a provider’s position, but it is not necessarily the binding contract.
1. Identify the service and the documents that govern it
Start with the service you will actually use—not the provider’s general brand or a broad statement about its AI products. Record the product name, tier, account type (consumer, team, enterprise, or API), deployment route, and applicable region. A commitment for one product or plan may not cover another product, connected service, agent, or search feature.
As an Amazon Associate I earn from qualifying purchases.
Collect the terms of service, privacy notice, service-specific terms, data processing addendum (DPA), security addendum, order form, and any negotiated enterprise terms. Check how the documents fit together: if a privacy page and signed agreement differ, which document controls? OpenAI’s legal and policy index, for example, lists distinct materials including individual terms, service terms, a DPA, business terms, enterprise privacy information, and data-use guidance. For organizational use of Microsoft Copilot and Copilot Chat, Microsoft says the Microsoft Products and Services DPA and Product Terms apply, with Microsoft acting as processor; see Microsoft’s Copilot privacy documentation.
Quick wins for a faster PC:
Repair Windows errors before they cause bigger problemsFix Now →Scan for outdated or missing drivers - takes under a minuteDriver Scan →Clear out junk files and repair common Windows errorsFree Scan →2. Find out what the provider can do with your data
Review the rules separately for prompts, responses, uploads, connected data, telemetry, and feedback. Look for permitted uses such as delivering the service, model training or improvement, safety and abuse monitoring, analytics, human review, and legal compliance. For each use, establish whether it is a default, an opt-out, an opt-in, or a negotiated commitment, and confirm that any setting applies to the account and feature in question.
Training and model improvement
OpenAI states on its business data privacy page: “By default, we do not use data from ChatGPT Enterprise, ChatGPT Business, ChatGPT Edu, ChatGPT for Healthcare, ChatGPT for Teachers, or our API platform—including inputs or outputs—for training or improving our models.” The statement is limited to the named products and says “by default”; it should not be generalized to every OpenAI product or treated as an independent assessment.
Anthropic says customers can opt out of model training through account settings and describes customer-content rights and confidentiality in its transparency materials. Microsoft says specified organizational Copilot prompts, responses, and Microsoft Graph data are not used to train foundation models, while distinguishing web-query handling in its Copilot privacy documentation. These are provider-specific descriptions with different product scopes, not a like-for-like comparison under identical terms.
Human review and monitoring
Training is only one possible use. Check whether content may be reviewed by people or processed for safety, abuse detection, support, or service improvement, and whether these rules differ for feedback, flagged conversations, or connected data. Do not infer a “no training” promise to mean “no retention,” “no monitoring,” or “no human access”; look for each rule explicitly.
Crashes, No Sound, or Screen Glitches?
Random freezes, missing sound and display glitches usually trace back to one bad driver. Find and replace yours safely.Free scan · under a minutePC Slower Than It Used to Be?
A free scan shows the junk files, broken settings and background clutter dragging Windows down - then fixes them in one click.Free scan · Windows 10 & 11Rank #2
- Used Book in Good Condition
3. Check retention and deletion by data type
Ask how long each category is kept and what deletion actually means. Saved chat history, backend copies after deletion, abuse-monitoring logs, application state, uploaded files, backups, and data held for legal or policy reasons may follow different rules. Also check whether retention controls require approval and whether they cover every endpoint and feature.
Anthropic’s Privacy Center (2026) says API inputs and outputs are deleted from its backend within 30 days, subject to exceptions such as a service with longer retention, a different agreement, policy enforcement, or legal requirements. For commercial products that save conversations, its guidance says conversations remain in product history to support continuity; after a user deletes a conversation, it is removed from history immediately and backend systems within 30 days. These are Anthropic’s published timeframes and exceptions, not an industry standard. See Anthropic’s retention guidance.
OpenAI’s API documentation says Zero Data Retention controls require approval and warns that some endpoints or capabilities may retain application state even when the control is enabled. Check the eligible endpoints and features in the API data controls documentation; do not assume a zero-retention label covers every API path.
4. Read the DPA and the service agreement together
A DPA matters only if it applies to the service, data, and features in use and is incorporated into the governing agreement. Check its scope and the provider’s role, along with instructions for processing, confidentiality, security measures, subprocessors, international transfers, breach notification, assistance with individual rights requests, data return or deletion, audit evidence, and exceptions.
OpenAI’s DPA says it governs customer data submitted through the API or specified business services under the applicable business terms, enterprise agreement, or other governing agreement. It also says certain compliance materials are provided on reasonable request no more than annually. Microsoft identifies the DPA and Product Terms as the basis for its organizational Copilot commitments and says it acts as processor for that use; see Microsoft’s documentation. Confirm that your own order and product configuration fall within the stated scope.
5. Evaluate security controls and evidence
Separate a provider’s security description from its contractual promises and from independent assurance. Check which service and environment were assessed, whether an independent report is available, what the provider commits to maintain, and what security settings your organization must configure. A certification or badge alone does not explain the assessed scope or customer responsibilities.
Rank #4
- Used Book in Good Condition
OpenAI’s business data security description states that it uses AES-256 encryption at rest and TLS 1.2 or higher in transit, and lists certifications and audit information for specified services. These are OpenAI’s stated controls, not an independent security assessment; see its business data page. Microsoft says enterprise protections include encryption, tenant isolation, and application of organizational identity, permissions, sensitivity labels, retention settings, and audit controls; details vary by subscription. See Microsoft’s Copilot privacy documentation.
6. Check service commitments separately from privacy
Privacy and security terms do not tell you whether the service has an uptime target, support-response commitment, scheduled-maintenance rules, incident-notice deadline, service credits, liability cap, suspension right, or data-export and transition support. Find the service-level terms and order form for the exact plan, determine what qualifies as an outage, and check the remedy and claim process. The documents identified in OpenAI’s policy index and its DPA do not establish one comparable availability or support commitment across providers. Use the applicable contract rather than assuming a particular percentage, response time, or remedy.
7. Follow data through connectors, agents, and search
Map every connector, retrieval source, agent, browsing or search function, plug-in, API endpoint, and subprocessor involved in the workflow. For each one, ask what information leaves the core service, which party controls that processing, what separate terms apply, and whether the same retention, residency, training, and compliance commitments follow the data.
Microsoft says Copilot web queries are sent to Bing under separate data-handling practices and terms, and advises checking an agent’s own privacy statement and terms. That means a core Copilot commitment should not automatically be applied to every connected path; see Microsoft’s Copilot privacy documentation. OpenAI’s endpoint-specific API guidance likewise illustrates why controls should be checked against the particular capability used: API data controls.
8. Compare providers or plans on the same questions
When you have real options, compare documents side by side rather than treating broad marketing statements as equivalent. Use the same scope and questions for each option:
- Covered product, plan, account type, contract hierarchy, and region.
- Permitted uses of prompts, outputs, uploads, telemetry, and feedback.
- Training, human review, safety monitoring, and whether user controls are defaults or contractual terms.
- Retention and deletion rules by data type, endpoint, and connected feature.
- DPA scope, processing roles, subprocessors, locations, and legal assistance.
- Security controls and independent assurance for the service actually purchased.
- Availability, support, incident notice, remedies, liability, suspension, and exit terms.
- Separate handling for browsing, search, connectors, agents, and external integrations.
Keep a copy of the applicable terms and record the date you checked them. Provider documentation and contract terms can change; recheck them before procurement and when the service, plan, or workflow changes. Whether a service is appropriate for particular data depends on the data, jurisdiction, configuration, contract, and organizational obligations; this checklist is not a legal determination.
Free tools Windows power users keep installed
One-click scans. No signup required.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
