ChatGPT privacy policy explained in plain English

01Which ChatGPT privacy policy applies to you?

OpenAI publishes more than one version. The US privacy policy points readers in the European Economic Area, the United Kingdom and Switzerland to a separate version. Who is responsible for your data also differs: OpenAI Ireland Limited for people in the EEA or Switzerland, and OpenAI OpCo, LLC anywhere else. We read the US version only.

The policy does not cover content OpenAI handles for business customers such as API users; customer agreements govern that. It sends readers to a separate page on how your data is used to improve models for training.

02What does the policy say OpenAI collects?

Section 1 sorts data into what you provide and what OpenAI receives from your use.

• Account information: name, contact details, login details, date of birth, payment information and transaction history.
• User content: prompts and uploads such as files, images, audio, video and data from connected services.
• Log, usage and device data: IP address, browser, request times, features used, feedback on replies and device identifiers.
• Location: a general area from your IP address, and precise location only if you allow it.
• Contacts, if you choose to connect your address book.
• Other sources: security and safety partners, marketing vendors, advertisers, and public web pages used to build models. For Free and Go users, ad history and interests.

03What does OpenAI say it does with that data?

Section 2 lists the purposes: running and improving the service, research, personalising your experience, personalising ads for Free and Go users, contacting you, marketing, preventing fraud and misuse, and complying with the law. It also lists estimating your age to give an age-appropriate experience.

On training, the policy says OpenAI may use your content to train the models behind ChatGPT, and points to an opt-out. It also says it makes de-identified or aggregated data and uses it for the same purposes without trying to identify you again, unless the law requires it.

Section 3 says data can go to vendors and service providers, affiliates, marketing partners, authorities when the law requires or OpenAI believes a rule was broken, parties in a business sale, administrators of a business account you joined and, for linked teen accounts, a parent or guardian.

04What does it say about keeping data, your rights and children?

A policy can be overridden by a court. OpenAI says a 2025 legal order to keep consumer content set aside its normal 30-day practice until it ended on 26 September 2025.

• Deleting: if you delete chats, memories or your account, OpenAI says it removes the data within 30 days, unless it must keep it for security, safety or legal reasons or it was already de-identified.
• Temporary Chats are deleted automatically within 30 days, with the same exceptions.
• Longer retention: banned content or accounts, legal demands such as a subpoena, payment records and a record of your erasure request.
• Rights: depending on where you live, you may be able to access, correct, delete, restrict or move your data, and to complain to your data protection authority.
• Children: the service is not meant for under-13s, and people under 18 need permission from a parent or guardian.

05What does the policy not tell you?

A policy summarises practice; it does not prove it. These are gaps we noticed.

• It gives categories and a 30-day deletion window, not a retention period for every kind of data.
• It lists types of vendors, not their names.
• The pages we read do not explain how personal information is reduced in training data, or what happens to training already done if you opt out later.
• One reason for sharing with authorities is OpenAI's own judgment that a rule has been broken.

06How do you act on your rights?

The policy points to account tools first and a request portal second.

1. In ChatGPT, open Settings and Data Controls to export, delete or control training. Labels are as OpenAI's help article describes them in October 2026, and menus change.
2. For requests the app cannot handle, use OpenAI's privacy portal or the data request email address given in the policy.
3. If you are unhappy with the answer, you can complain to your local data protection authority. For legal advice, ask a lawyer.