AI and Privacy: What Happens to the Documents You Upload

The question comes up the moment you try to use AI for real work: you have a contract, a medical letter, a payslip, or a client file, and you want a summary. Is it safe to upload it?

The honest answer is that it depends on the provider, the plan you are on, and settings most people never open. This is a practical guide to what actually happens to a document you upload, which promises are worth something, and how to get AI help on genuinely sensitive material without handing it over at all.

What actually happens when you upload a file

Uploading a PDF to an AI assistant sets off a longer chain than the chat window suggests:

The file is transmitted to the provider infrastructure, in transit encryption included.
It is stored, at least temporarily. The service needs the document to answer follow-up questions, so it typically persists for the life of the conversation and often well beyond it.
The text is extracted and usually split into chunks, each converted into a numerical representation and written to a search index. These derived copies have their own lifetimes and are frequently missed by deletion requests.
The content enters a model prompt, and prompts are commonly logged for debugging, abuse monitoring, and quality work.
Humans may read a sample. Most major providers reserve the right to have staff or contractors review flagged or sampled conversations.
It may train future models — this is the part that varies most by provider and plan, and the part people most want to control.

Every step is defensible on its own. Together they mean a document you uploaded exists in more places, for longer, than the single copy you pictured.

The distinctions that actually matter

Privacy policies are long, but for documents only a few questions change the outcome.

Consumer plan or business plan

This is the biggest single fork. Free and personal tiers of most assistants may use your conversations to improve their models by default. Business, team, and enterprise tiers of the same products generally do not, and are covered by a data processing agreement. The identical product can carry opposite defaults depending on which door you came in through.

Training opt-out versus retention

These get conflated constantly and they are not the same thing. Turning off training means your content is not used to teach future models. It does not mean the content is not stored — retention periods of thirty days or more for abuse monitoring are normal even with training disabled. If your concern is that the data exists at all, an opt-out does not solve it.

Deletion that reaches the copies

Deleting a conversation removes it from your history. Whether it removes the extracted text from the search index, the logged prompt, and any backup is a separate question, and one policies often answer vaguely.

Who else is in the chain

Many AI features are built on another company model. Your document may pass through a vendor you have never heard of and never agreed terms with. This is normal, disclosed in subprocessor lists, and almost never read.

Documents you should not upload to a general AI tool

Not because a breach is likely, but because the consequences are not yours alone to accept:

Anything under NDA or legal privilege. Disclosure to a third-party processor can breach the agreement and, in some circumstances, weaken privilege.
Health records. Regulated in most countries; a consumer AI tier is not a compliant environment.
Other people's personal data — client lists, employee files, applicant CVs. Under GDPR you are the controller and you need a lawful basis to send it anywhere.
Financial statements and identity documents. Bank details, tax filings, passport scans.
Unreleased commercial material. Strategy, pricing, code, anything whose value depends on nobody else having it.

Worth saying plainly: the major AI companies are not casually leaking documents, and their security is better than most organisations manage internally. The risk is not villainy. It is that data which exists can be breached, subpoenaed, mishandled by a subprocessor, or retained longer than you assumed — and none of that can happen to data that was never sent.

The alternative: AI that never receives the file

The cleanest fix is architectural. If the model runs on your device, the privacy question dissolves rather than being managed. There is no upload, no retention window, no training question, no subprocessor.

This used to require a technical setup. It no longer does. Our AI PDF summarizer and chat with PDF tools download a compact language model into your browser once and then run it on your own hardware. Your document is opened, read, and answered locally. We could not see it if we wanted to, because it never arrives — and you can prove that by disconnecting from the internet after the model loads and watching it keep working.

The trade-off is capability: a browser-sized model is not a frontier model, so it is excellent at summarizing, locating, and extracting, and weaker at hard reasoning. For confidential documents that is usually the right bargain — a good summary you can verify against the source beats a brilliant one that required surrendering the file. There is more detail on how this works in what is local AI.

If you do use cloud AI, reduce what you hand over

Redact before uploading. Names, account numbers, and addresses are rarely needed for the question you are asking. Our automatic redaction tool finds and removes personal data locally, before anything is sent — and it removes the underlying text rather than drawing a black rectangle over it.
Send the extract, not the file. Pasting the one relevant clause exposes far less than uploading the whole contract. PDF to text makes that quick.
Turn training off and check it stayed off. Settings sometimes reset after plan changes.
Use the business tier for work documents. The default terms are materially different.
Strip the metadata. PDFs carry author names, software, and revision history that you are uploading without noticing — our metadata editor clears it.

The short version

Ask one question of any AI tool before you feed it a document: does this file leave my computer? If it does, you are relying on a policy, and policies vary by plan, change over time, and are enforced by companies whose incentives are not identical to yours. If it does not, you are relying on architecture, which does not have moods.

For public and routine material, cloud AI is convenient and the risk is negligible. For the documents you would hesitate to forward to a stranger, use a model that runs where the document already lives.