OpenAI keeps personal data only as long as needed, depending on data type, use and your settings
OpenAI says it retains Personal Data only as long as it needs to in order to provide the Services to you, or for other legitimate business purposes such as resolving disputes, safety and security reasons, or complying with legal obligations. How long a given item is kept depends on the type of data, how it is used and, in many cases, your settings. The policy gives no single retention period.
Supporting quotations
4. Retention
We’ll retain your Personal Data for only as long as we need in order to provide our Services to you, or for other legitimate business purposes such as resolving disputes, safety and security reasons, or complying with our legal obligations. How long we retain Personal Data depends on the type of data, how we use it, and in many cases your settings:
Qualifications & exceptions
The purposes listed (disputes, safety, security, legal obligations) are examples of legitimate business purposes.
Retention depends on data type, use and in many cases your settings.
Not stated here
The policy does not give a retention period for most data types.
Retention & Deletion · Company commitment
After you delete data it is removed within 30 days, with exceptions for longer retention and de-identified data
Some Services let you delete Personal Data stored in your account, such as specific or all ChatGPT conversations, specific Memories, or your account. Once you choose to delete, OpenAI says it will remove the data from its systems within 30 days. Two exceptions apply: it may retain data for longer as described in the later retention reasons, and the 30-day removal does not cover data that has already been de-identified and disassociated from your account when you allow OpenAI to use your Content to improve its models. The policy separately says de-identified information is kept and used in de-identified form.
Supporting quotations
Some of our Services allow you to delete Personal Data stored in your account. For example, you can delete specific, or all, of your ChatGPT conversations, delete specific
or delete your account.
Once you choose to delete Personal Data, we will remove it from our systems within 30 days unless we need to retain it for longer as described below, or it has already been de-identified and disassociated from your account when you allow us to use your Content to
We will maintain and use de-identified information in de-identified form and not attempt to reidentify the information, unless required by law.
Qualifications & exceptions
Applies to data you delete using the Services' deletion features.
Exception: longer retention reasons described later in the section.
Exception: data already de-identified and disassociated from your account when you allow Content to be used to improve models.
Not stated here
The policy does not say when or how Content is de-identified and disassociated, so which deleted data falls in that exception is unknown.
Retention & Deletion · Company commitment
Temporary Chats are deleted automatically within 30 days, unless kept for safety or legal reasons
In some cases Personal Data is deleted automatically. As an example, Temporary Chats will be automatically deleted within 30 days, unless OpenAI has to retain them for safety or legal reasons as described further below.
Supporting quotations
In some cases, Personal Data will be deleted automatically.
will be automatically deleted within 30 days (unless we have to retain them for safety or legal reasons, as described further below).
Qualifications & exceptions
Exception for safety or legal retention.
Not stated here
Other data types that are deleted automatically are not listed.
Retention & Deletion · Permission or license
Data can be kept after deletion for banned content, legal requirements, fraud and security
OpenAI says it may need to keep Personal Data longer, even after you delete it, for example because it is legally required to, to address fraud and abuse, for security reasons, or for financial record-keeping. The examples are: if specific Content or your account is banned for violating the usage policies, OpenAI may retain that data to protect its services from fraud, abuse or other violations; and if OpenAI is legally required to retain your data, such as under a lawful subpoena, it may keep it for the duration of the legal or regulatory obligation.
Supporting quotations
In some cases, we need to retain Personal Data for longer even after you delete it, for example because we are legally required to, to address fraud and abuse, for security reasons, or for financial record-keeping purposes.
If specific Content, or your account, is banned because of violations of our
we may retain that data for to protect our services from fraud, abuse, or other violations of our policies;
If we are legally required to retain your data (for instance, we receive a lawful subpoena) then we may retain it for the duration of the relevant legal or regulatory obligation;
Qualifications & exceptions
Applies even after you delete the data.
The examples (banned Content or accounts, legal requirements) are introduced with "for instance".
Not stated here
No duration is given for retaining banned Content or accounts.
The source sentence on banned Content reads "retain that data for to protect", which is unclear wording; this analysis does not guess what was meant to follow "for".
Payment records and an audit record of erasure requests are kept after deletion
When OpenAI is a party to a financial transaction, for example processing payment for a ChatGPT Plus or Pro account or facilitating a purchase on ChatGPT, it may retain payment and transaction information for accounting, dispute resolution and regulatory compliance. When you ask OpenAI to delete your Personal Data, it retains the audit record of the erasure request so it can verify it complied.
Supporting quotations
When we are a party to a financial transaction (for instance, when we process your payment for a ChatGPT Plus or Pro account, or facilitate a purchase on ChatGPT), we may retain payment and transaction related information to meet our accounting, dispute resolution, and regulatory compliance purposes;
When you ask us to delete your Personal Data, we retain the audit record of the erasure request to be able to verify that we have complied with the request.
Qualifications & exceptions
Financial retention is stated as "may"; the audit record of erasure requests is stated as retained.
Not stated here
No retention period is given for payment records or the audit record.
Retention & Deletion · Company practice
Retention periods are set by considering purpose, data sensitivity, risk of harm and legal requirements
In determining retention periods OpenAI says it considers its purpose for processing the data (such as whether it needs the data to provide the Services), the amount, nature and sensitivity of the information, the potential risk of harm from unauthorized use or disclosure, and any legal requirements it is subject to.
Supporting quotations
In determining these retention periods, we consider a number of factors, such as:
Our purpose for processing the Personal Data (such as whether we need to retain it to provide our Services);
The amount, nature, and sensitivity of the information;
The potential risk of harm from unauthorized use or disclosure;
Any legal requirements that we are subject to.
Qualifications & exceptions
The list of factors is introduced with "such as" and is not stated to be complete.
Not stated here
How the factors translate into specific periods is not described.