Can You Trust an AI Chatbot With Customer Data?
How much can you trust an AI chatbot with customer data depends less on the vendor's marketing page and more on three things you control: the plan you are on, what you paste into the box, and who can read the logs afterwards. The short answer as of September 2026: business and enterprise tiers from the big providers do not train on your content by default, consumer tiers often do unless you switch it off, and none of them are truly zero retention. OpenAI, for example, still stores chats for 30 days for abuse monitoring even when you have turned training off.
That last detail is the one most articles skip, and it changes how you should handle a customer's phone number or a support ticket with an address in it.
The honest answer in one paragraph
Trust an AI chatbot with customer data the way you would trust a contractor with a spare key: fine for the front door, not for the safe. The commercial plans give you a contractual promise about training, an admin console, and retention controls. What they do not give you is a guarantee that a misconfigured connector, a staff member pasting the wrong thing, or a hallucinated answer to a customer will never expose something. Those failure modes sit on your side of the line, and they are where real small business leaks happen.
What the vendors actually promise (September 2026)
The promises are narrower than the headlines suggest, and they are worth reading in the specific words the vendors use.
OpenAI states that by default it does not train models on inputs and outputs from its business products, which covers ChatGPT Business (formerly Team), ChatGPT Enterprise, and the API. Organisations are opted out of data sharing unless they explicitly opt in. For consumer ChatGPT it is the reverse: OpenAI collects conversation content, device identifiers, location data and usage patterns, and may use that to train models unless you disable training in Data Controls. Even with history and training switched off, OpenAI keeps chats for 30 days to monitor abuse before deleting them.
Google splits the same way. The Google Workspace Privacy Hub states that interactions with Gemini stay within your organisation and are not shared outside it without permission, that customer content is not human reviewed or used to train generative AI models outside the customer's domain without permission, and that Gemini can only access Workspace content the user already has permission to see. Admins can control whether prompts and responses are stored and for how long, up to 36 months, before automatic deletion. Data stored through Workspace is treated as customer data under the Cloud Data Processing Addendum.
The consumer Gemini side has a wrinkle worth knowing. The Gemini Apps Privacy Notice, updated 1 July 2026, covers data from third party services connected through Model Context Protocol, and Google says plainly that it does not monitor or secure data from custom third party connected apps. Responsibility for security in those connected tools sits with you or the tool's provider. Google also offers temporary chats that are not used to improve its AI, with the controls now living under Gemini Spark settings.
Read that MCP line twice if you plan to connect a chatbot to your CRM or your inbox. The chatbot vendor is telling you in advance that the connector is your problem.
Consumer plan vs business plan, side by side
| Question | Consumer plan | Business or Workspace plan |
|---|---|---|
| Trained on your content? | ChatGPT consumer: yes, unless you disable training in Data Controls | OpenAI business products: no by default, opt in required |
| Retention after you disable training | OpenAI keeps chats 30 days for abuse monitoring | Workspace admins set storage, up to 36 months, then auto delete |
| Who governs the data | The vendor's consumer privacy notice | Workspace: customer data under the Cloud Data Processing Addendum |
| Access scope | Whatever you paste in | Workspace Gemini sees only what the user already has permission to see |
| Third party connectors | Gemini Apps: Google does not monitor or secure custom MCP connected apps | Admin governance available in Workspace |
| Data residency | Not offered | ChatGPT Enterprise offers data residency; Business does not |
Every figure in that table was checked on 6 September 2026, and vendor policies change without advance notice. Re-check the official policy page before you rely on any single line of it.
What it costs to get the safer tier
The gap between the consumer tier and the tier with real controls is smaller than most owners expect, and for a two person shop it is roughly the price of one lunch a month.
ChatGPT Business runs $20 per user per month billed annually, or $25 monthly, with a two seat minimum, checked 6 September 2026. A premium seat launched in August 2026 at $100 per user per month annually or $125 monthly, giving around five times the usage of a Standard seat and removing a five hour usage limit. Business is aimed at teams of roughly 2 to 149 seats and does not include enterprise data residency. Pricing trackers also report an April 2026 price cut that brought Business down to the $20 and $25 figures.
ChatGPT Enterprise is quote only. Procurement reports for 2026 cluster around $45 to $75 per user per month, averaging about $60, with a minimum of roughly 150 seats and annual prepay, which puts the floor near $108,000 a year. That is the tier where data residency and the advanced compliance features live, and it is out of reach for the readers of this site.
Google Workspace, checked 6 September 2026, starts at about $7 per user per month annually for Business Starter, around $14 for Business Standard, and around $22 for Business Plus, with flexible monthly rates of $8.40, $16.80 and $26.40 respectively. Enterprise is custom priced. Expanded AI access on Business Standard, Business Plus and Enterprise lists between 5,000 and 25,000 AI functions per month depending on tier. Business Starter has no expanded access. On the consumer side, Google tracks Free, Google AI Plus at $4.99 a month, Google AI Pro at $19.99 and Google AI Ultra at $99.99 as of September 2026.
Check the official pricing page before you commit. These numbers were accurate on the day of writing and both vendors have already moved prices this year.
The three ways small businesses actually leak data
Leaks in small businesses almost never come from the model itself. They come from the plumbing around it.
The wrong plan. Someone on the team has a personal ChatGPT account, pastes a customer email thread in to draft a reply, and the training toggle was never touched. The vendor's business promise does not apply to that account. This is the single most common version, and it costs nothing to fix.
The connector nobody audited. You wire a chatbot into your CRM, your helpdesk or your inbox through a connector or an MCP integration. Google says outright that it does not monitor or secure data flowing through custom third party connected apps. If that connector logs to a third party dashboard, your customer records are now in a place you never reviewed. If you are building this kind of plumbing, the same care applies to your automation layer, which is why the trade-offs in n8n versus Zapier for small business automation matter more than the price difference.
The log nobody rotates. Retention is a setting, and settings default to convenient. A Workspace admin can hold prompts and responses for up to 36 months. Three years of customer conversations sitting in a workspace where every staff member past and present had an account is a genuine liability, and it is invisible until something goes wrong.
Fix the account hygiene first. A shared password on a business AI account undoes every policy control above it, which is the same reason a real password manager is the cheapest security spend a one person business makes.
Hallucination is a data problem too
An AI chatbot that invents an answer to a customer damages you even when no data leaks.
A support bot that confidently tells a customer their order shipped, or quotes a refund policy you do not have, is generating false information about that customer's account. You will spend the same afternoon apologising as you would after a small leak. Surveys on chatbot reliability and customer trust circulate widely, but their numbers vary by method and sample and this site could not confirm a single named publisher behind a consistent figure worth printing here — so the honest statement is that hallucination is a known risk in customer service use, not a number to cite. If you are weighing this for a support desk, the honest pros and cons in ChatGPT for customer support cover where the failure line sits in practice.
A practical trust checklist
Work through these in order, because the early ones cost nothing and remove most of the risk.
- Move everyone off personal accounts. One business workspace, admin controlled. On OpenAI's business products the no training default only applies to the organisation's accounts.
- Check the training toggle anyway. For consumer accounts still in use, disable training in Data Controls. Remember the 30 day abuse retention window still applies.
- Set a retention period deliberately. In Workspace, choose how long prompts and responses are stored rather than accepting whatever is there. Shorter is safer.
- Minimise what you paste. A customer's name and order number is usually enough context. Card details, full addresses, health information and identity documents should never enter a general purpose chatbot.
- Audit every connector. Anything connected through MCP or a third party integration is outside the vendor's security monitoring by their own admission.
- Write down who has access. Offboarding a contractor means removing their seat, not just changing the shared login.
Who should not put customer data into an AI chatbot at all
Some businesses should stay out of this entirely, and the honest answer is worth more than a sale.
If you handle health records, legal case files, financial account details or children's data, a general purpose chatbot on a $20 seat is the wrong tool. The compliance features and data residency you need sit in ChatGPT Enterprise, which starts around 150 seats and roughly $108,000 a year on 2026 procurement figures. If you cannot reach that tier, the answer is to keep the regulated data out and use the chatbot only for generic drafting.
If you operate under strict data residency rules, note that ChatGPT Business does not include enterprise level data residency. That is a specification, not an opinion.
If your workflow depends on the bot being right without a human checking it, stop. Given the reliability concerns above, an unreviewed customer facing bot is a liability whatever the privacy policy says.
FAQ
Does ChatGPT train on my business data?
Not by default on business products. OpenAI states that inputs and outputs from ChatGPT Business, ChatGPT Enterprise and the API are not used to train its models unless the organisation explicitly opts in. Consumer ChatGPT is different: conversation content may be used for training unless you disable it in Data Controls.
If I turn off chat history, is my data deleted immediately?
No. OpenAI keeps chats for 30 days to monitor abuse before deleting them, even when history and training are turned off. Plan around that window rather than assuming instant deletion.
Is Google Gemini safe for customer data in Workspace?
Workspace Gemini is the safer of the two Gemini surfaces. Google's Privacy Hub states that interactions stay within your organisation, that content is not human reviewed or used to train models outside your domain without permission, and that Gemini can only reach content the user already has permission to access. Consumer Gemini Apps carry different terms.
How long does Google Workspace keep my Gemini prompts?
Admins choose. Workspace lets an administrator control whether prompts and responses are stored and for how long, up to a maximum of 36 months, after which they are deleted automatically. Setting this deliberately is one of the highest value five minute tasks in this whole article.
Are third party chatbot connectors covered by the vendor's privacy promise?
No, and Google says so directly. Its Gemini Apps Privacy Notice, updated 1 July 2026, states that Google does not monitor or secure data from custom third party connected apps, including those linked through Model Context Protocol. Security there is your responsibility or the connector provider's.
What customer data should never go into an AI chatbot?
Payment card numbers, government identity documents, health information, full financial account details and anything covered by a specific regulatory regime you have not cleared with counsel. Name, order number and the gist of the issue is enough for the bot to be useful in most support workflows.
Verdict
Business tier chatbots are trustworthy enough for ordinary customer service text, and the paid tier costs about $20 per seat a month on OpenAI or $14 on Google Workspace Business Standard as of 6 September 2026. The vendors have made the training question answerable in writing. What they have not solved, and cannot solve for you, is the connector you never audited, the retention window you never set, and the intern pasting a full customer file into a personal account. So how much can you trust an AI chatbot with customer data comes down to this: trust the policy, verify the plumbing, and keep the regulated data out.
About the author
This is written by the team behind The Tool Signal, who run AI tooling in a working small business every day: drafting support replies, wiring automations between a CRM and an inbox, and paying the invoices for the seats mentioned above. Every price here was checked on the vendors' own pages on 6 September 2026 and is quoted with its date so you can tell when it has gone stale. Where the research did not give a firm attribution, this article says so instead of dressing a number up as a citation.