The main risks of using public AI tools with customer data come from the vendors' own terms, not from hackers: staff pasting customer records into personal accounts that train by default, retention windows that outlast the task, flagged conversations kept for years, connected apps, and data residency limits. Each one is set out below from the vendor's published terms. The brand remains responsible for its customers' data whichever tool processed it.
What are the risks, and what do the vendors' terms say?
The table lists five risks for an ecommerce brand's customer data, each with the term that creates it and the people it affects. Private AI vs public AI explains the difference between the plans these terms belong to.
| Risk | What the vendor's terms say | Who it affects |
|---|---|---|
| Staff on personal accounts | ChatGPT Free, Plus and Pro: content is used to train OpenAI's models, opt-out available. Feedback on a response can send the whole conversation into training. | Anyone who pastes an order export, support thread or customer list into a personal account |
| Retention after the task | OpenAI API: inputs and outputs kept up to 30 days to provide the service and identify abuse. Anthropic covered models: 30 days on every platform, including for zero-retention customers. | Teams on business plans and APIs |
| Flagged conversations | Anthropic: inputs and outputs kept up to 2 years and safety scores up to 7 years if a chat is flagged. Feedback kept 5 years. | Any organization whose chats trip an automated safety flag |
| Connected apps and files | OpenAI does not train on data accessed from apps by default. Anthropic excludes raw connector content from consumer training, but not data copied into the conversation. | Teams that connect Google Drive, a CRM or order exports to a chat assistant |
| Data residency | OpenAI API: residency outside the US needs approval for abuse monitoring controls and a Modified Retention amendment, and system data may be stored outside the region. ChatGPT Pro has no data residency. | Brands with EU, UK or Gulf customers |
Why are personal accounts the biggest risk?
A business plan does nothing for data typed into a personal one. On OpenAI's consumer plans, training is on by default, and a single rating can widen what is used:
If you choose to provide feedback, such as selecting thumbs up or thumbs down on a response, the entire conversation associated with that feedback may be used to train OpenAI models.
A support agent who pastes a customer's complaint and order history into a personal account to draft a reply, then rates the answer, has sent that customer's record into a training set, and nothing in the brand's own systems records it. The fix is policy and provisioning: a business seat for everyone who handles customer data, and a rule that customer records never go into a personal account.
Does a business plan or zero-retention API remove the risk?
It removes training, not retention. OpenAI says data from ChatGPT Business, Enterprise and the API is not used for training unless the customer opts in, and Anthropic's commercial terms say the same. Both still keep data for a period. OpenAI offers zero data retention on request for eligible endpoints, but its platform documentation notes that endpoints not eligible for it may still store application state even when it is enabled. Anthropic's covered models, its Mythos-class and Fable models, keep data even for zero-retention customers:
Prompts submitted to, and outputs generated by, covered models are retained for 30 days to support our safety work, on every platform where these models are offered.
Anthropic says that by default no Anthropic personnel can read those retained conversations. The records still sit outside the brand's account for 30 days, which matters for a customer deletion request or a privacy audit.
What should an ecommerce brand do instead?
Take the steps in order, cheapest first. Each one closes a risk in the table.
- Put everyone who handles customer data on a business plan with training off, and ban customer records from personal accounts. This closes the biggest risk for the price of seats.
- Remove personal data before the model call and log what is sent. Names, emails, addresses and order numbers can be masked automatically before a prompt leaves the brand's systems. AI data security on AWS covers this redaction, access control and audit logging.
- Use a zero-retention API for workflows that must send customer records to a public model, and check which models and endpoints it actually covers.
- Move customer-record work into private AI. Support replies on order history, segmentation on customer profiles and models tuned on customer data can run on a private LLM in the brand's own cloud account, where no model vendor keeps a copy. On-premise or private-cloud LLM sets out how to deploy one, and what a private LLM costs to run prices it.
Brand Media Works, an AI consulting and marketing data engineering firm for ecommerce brands, builds steps 2 and 4 inside the brand's own AWS account. Private AI for business covers when a marketing team needs the last step at all.
Frequently asked questions
Do connectors like Google Drive send customer data to the AI vendor?
Yes, connected files are read by the vendor's service when the assistant uses them. OpenAI says it does not train on data accessed from apps by default, and Anthropic excludes raw connector content from consumer training, but anything copied into the conversation may be included.
Does zero data retention mean the vendor keeps nothing?
Not always. Anthropic keeps prompts and outputs from its covered models for 30 days on every platform, including for zero-retention customers, and OpenAI notes that some endpoints may still store application state with zero data retention enabled.
What is the cheapest first step?
Business seats with training off for everyone who handles customer data, and a written rule that customer records never go into personal AI accounts.